GITEA 1.27.1 PATCHES UNAUTHENTICATED ARBITRARY FILE READ AND SEPARATE RCE VIA GIT HOOKS

Summary from the TLDR InfoSec newsletter

Gitea 1.27.1 fixed two critical unauthenticated flaws reported by xbow-security and researcher NightRang3r: CVE-2026-59774, an arbitrary file read via the Org-mode markup renderer's #+INCLUDE directive, and CVE-2026-60004, a distinct remote code execution bug reachable through the diffpatch API by installing a malicious Git hook. Both affect versions 1.22.1 through 1.27.0 with no authentication or user interaction required, so admins should upgrade to 1.27.1 immediately regardless of which attack path they're worried about.