CVE-2026-73539 Details

A remote code execution vulnerability exists in Gitea versions through 1.27.1. The issue arises because Gitea injects a URL from the markup Context field into external renderer command templates without properly escaping the reference path before splitting it for shell execution. This flaw allows for the injection of additional renderer arguments, including options that can load executable filter files. On systems using a vulnerable external renderer like Pandoc, a user with the ability to place a filter file in an accessible location can execute it as the Gitea service account. The vulnerability can be exploited through the public repository markup endpoint, which is accessible without authentication.

Users can upgrade to Gitea version 1.27.2, which addresses this vulnerability by properly escaping the Context field before it is used in external renderer commands.