Command Injection Vulnerability in Gitea Affecting Renderer Options

CVE-2026-73539

What is CVE-2026-73539?

A vulnerability in Gitea allows for command injection through the improper handling of the markup Context field. This flaw permits an attacker to manipulate external renderer command templates, potentially executing unwanted filter files on systems where these files can be placed in accessible locations. By leveraging this vulnerability, an adversary could cause executable files to run as the Gitea service account, compromising the integrity and security of the Gitea deployment. The vulnerability is particularly concerning for environments using susceptible external renderers like pandoc, where public repository markup endpoints may be accessed without authentication.

References