Gitea patched a critical flaw in the self-hosted Git platform that lets an unauthenticated attacker read any file the service account can access, needing only a public repository and crafted Org-mode markup. Tracked as CVE-2026-59774 and scored 9.8, it stems from the markup-rendering endpoint: Gitea initializes its Org-mode library without restricting file access, so the include directive accepts absolute paths and returns their contents. No login or write access is required. Gitea warns it can chain to command execution: read the configuration file, extract the internal token, inject a Git hook, and trigger it during an anonymous clone. It affects versions 1.22.1 through 1.27.0, fixed in 1.27.1.
The Ruby on Rails team disclosed a critical flaw in Active Storage that lets an unauthenticated attacker read arbitrary files by uploading a crafted image. Tracked as CVE-2026-66066 and scored 9.5, it affects applications that use the libvips image library and accept image uploads from untrusted users, which is the default in modern Rails. Active Storage passes uploads to libvips without disabling its unsafe image loaders, so a malicious file can read the server process environment, exposing the secret key base, database passwords, cloud storage keys, and API tokens. Those secrets can enable code execution and lateral movement. Rails is not aware of exploitation, and full details are held until August 28.
TrustStrike Labs