CVE-2026-73539 in Gitea
Summary
by MITRE • 10/14/2026
Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting. A crafted Context can inject additional renderer arguments, including options that load executable filter files. On deployments using a susceptible external renderer such as pandoc, a user who can place a filter file at an accessible path can cause it to execute as the Gitea service account; the public repository markup endpoint itself can be reachable without authentication.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability described involves a critical command injection flaw within Gitea's handling of external renderers, specifically affecting how URL contexts are processed during markdown rendering operations. The core technical issue stems from improper input validation and sanitization when constructing shell commands for external processing tools like Pandoc. When the system receives a request containing a specific markup context field that includes a file path or URL reference, it substitutes this value directly into command templates without performing necessary escaping or argument splitting safeguards. This lack of proper isolation allows an attacker to manipulate the structure of the executed command by injecting additional arguments through carefully crafted input strings. The flaw essentially treats user-supplied data as part of the executable syntax rather than as a literal string parameter, creating a classic injection vector that bypasses standard security controls designed to separate code from data in shell environments.
From an operational perspective, this vulnerability poses severe risks because it enables remote code execution under the privileges of the Gitea service account. The attack chain typically begins with a user accessing the public repository markup endpoint, which often does not require authentication for viewing rendered content or triggering preview functions. By crafting a malicious context string that points to an accessible location where the attacker can place executable filter files, they can trick the external renderer into loading and executing these filters as part of its processing pipeline. Since Pandoc supports various filter types including Lua scripts and executables, this mechanism provides multiple avenues for code execution. The consequence is that any user with access to trigger markdown rendering on a vulnerable instance can achieve arbitrary command execution on the host system, potentially leading to full compromise of the server infrastructure hosting Gitea services.
This vulnerability aligns closely with Common Weakness Enumeration CWE-78, which defines Improper Neutralization of Special Elements used in an OS Command, commonly known as OS Command Injection. The specific mechanism also relates to CWE-94, where code injection occurs due to improper control of generation of code or scripts, particularly when user input influences the structure of executed commands without adequate sanitization. In terms of tactical classification within the MITRE ATT&CK framework, this behavior corresponds to T1059 Command and Scripting Interpreter, specifically leveraging shell commands for execution. The exploitation technique mirrors aspects of T1203 Exploitation for Client Execution if targeting client-side rendering tools, but in this server context it represents direct remote code execution via service account privileges, falling under techniques associated with initial access or privilege escalation depending on the deployment configuration and existing permissions.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. The primary solution is to apply vendor-provided patches that update Gitea versions to include fixes for this command injection vulnerability. Administrators should ensure all instances are upgraded promptly, as public-facing endpoints provide an easy attack surface without requiring authentication. Additionally, organizations running external renderers like Pandoc should restrict the execution environment by disabling filter loading capabilities if they are not strictly required for their use case. Implementing strict input validation that rejects or safely encodes special characters in context fields before passing them to shell commands is essential. Furthermore, deploying Gitea with least-privilege principles ensures that even if exploitation occurs, the blast radius is limited by restricting the service account's permissions on the underlying operating system and network resources.