{"uuid": "bdcd7133-dfa8-46f6-b422-bdb37b22ab03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"xbow-security\", \"NightRang3r\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Forgejo versions 7.0 through 15.0.5 and 16.0.0 through 16.0.1 are\\n          vulnerable to an arbitrary file read via the markup rendering API\\n          endpoint. The go-org library's default ReadFile callback\\n          (ioutil.ReadFile) is not overridden, allowing the #+INCLUDE directive\\n          to read arbitrary files accessible to the service user.\\n\\n          Valid credentials are required to access the API markup endpoint.\\n          Extracting sensitive files such as app.ini can expose INTERNAL_TOKEN\\n          and other secrets, potentially leading to remote code execution.\", \"disclosure_date\": \"2026-07-30\", \"fullname\": \"auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774\", \"is_install_path\": true, \"mod_time\": \"2026-08-12 10:32:09 +0000\", \"name\": \"Forgejo Arbitrary File Read via Org-mode Include\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"gather/forgejo_orgmode_fileread_cve_2026_59774\", \"references\": [\"CVE-2026-59774\", \"GHSA-6v53-hr58-556r\", \"URL-https://codeberg.org/forgejo/forgejo/pulls/13682\"], \"rport\": 3000, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-08-24T06:44:13.952103Z"}