Gitea Org-Mode Markup File Disclosure Vulnerability

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files, leading to a server-side file disclosure vulnerability.

An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account.

• Precondition: a suitable public repository is available.
• Impact: disclosure of server-side files, including app.ini and its INTERNAL_TOKEN.
• Further impact: with internal logger access, the attacker can modify a Git hook and execute commands as the Gitea service account.