Isa0-Gh

**Name of the Vulnerable Software and Affected Versions** Gitea versions 1.22.x and earlier **Description** A Local File Inclusion issue exists in the restore-repo command when processing release.yml files from user-supplied archives. The `DownloadURL` field in release attachments is passed to the `uri.Open()` function without scheme validation. Since `uri.Open()` supports the `file://` scheme via `os.Open()`, an attacker with operator-level access can use a crafted release.yml to exfiltrate arbitrary files accessible to the Gitea process user from the server filesystem. These files are then stored as release attachments and can be retrieved via the Gitea API. The issue is rooted in the `uri.Open()` function within `modules/uri/uri.go` and its invocation in `services/migrations/gitea uploader.go`. **Recommendations** Update Gitea to a version later than 1.22.x. In `services/migrations/gitea uploader.go`, validate that the `DownloadURL` scheme is restricted to http or https before calling `uri.Open()`. As a temporary workaround, restrict the execution of the restore-repo command to fully trusted operators and manually audit archive contents before restoration.