CVE-2026-73539

Deferred Deferred - Pending Action

Gitea External Renderer Command Injection

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-73539

EUVD

EUVD-2026-101105

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-88	The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea involves improper handling of the Context field in markup rendering. When constructing external renderer commands, user-controlled input is not properly escaped, allowing attackers to inject shell commands. This can lead to arbitrary code execution as the Gitea service user if certain conditions are met, such as enabled external markup rendering and write access to a repository.

Detection Guidance

To detect CVE-2026-73539, check if your Gitea instance is running a vulnerable version (up to 1.27.1). Verify if external markup rendering is enabled with $GITEA_PREFIX_SRC or $GITEA_PREFIX_RAW in the RENDER_COMMAND. Inspect repository write access permissions and check for unexpected file uploads or command injections in markup Context fields.

Impact Analysis

If exploited, this vulnerability could allow attackers to execute arbitrary code on the server running Gitea. This could lead to unauthorized access, data breaches, or service disruption. Attackers need write access to a repository to upload a malicious file and inject commands, but public repositories expose the vulnerable endpoint without authentication.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, which may violate compliance requirements under GDPR, HIPAA, or other regulations. Unauthorized code execution could expose sensitive data, leading to legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade Gitea to version 1.27.2 or later to apply the security fix. Disable external markup rendering if not required. Restrict repository write access to trusted users only. Review and remove any suspicious files or commands in markup Context fields. Ensure filesystem-backed APP_DATA_PATH is properly secured.

Hi! I’m here to help you understand CVE-2026-73539. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70