Gitea's Org-mode renderer can process INCLUDE directives in repository markup without validating that referenced files reside within the repository. This flaw permits an unauthenticated user to read any file readable by the Gitea service account and represents a path traversal weakness (CWE-22). If the target contains configuration such as app.ini with an INTERNAL_TOKEN, the attacker can chain this disclosure with internal logger access to modify a Git hook, enabling arbitrary command execution as the Gitea service account.

All Gitea installations running a version older than 1.27.1 are vulnerable. The issue was addressed in release 1.27.1, which patches the Org-mode INCLUDE handling to restrict file access.

The advisory assigns a CVSS score of 9.8, indicating high severity. The EPSS score of 28% indicates a notable probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the flaw from any public repository without authentication, leveraging the service account's file system access to read sensitive configuration and subsequently execute code by tampering with Git hooks. Detection would involve monitoring for unusual file reads and hook modifications.