PT-2026-63288 · Gitea+1 · Gitea+1
CVSS v3.1
8.5
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Gitea (affected versions not specified)
Description
Gitea contains a Server-Side Request Forgery (SSRF) issue where the repository migration process follows HTTP redirects after the initial URL validation. While Gitea validates the user-supplied migration URL against allow/block lists, the actual data transfer is delegated to the Git command-line client. By default, Git follows the first redirect, allowing an attacker to bypass URL policies and redirect the server to internal Git HTTP(S) endpoints.
This can lead to the exfiltration of internal Git repositories into an attacker-controlled Gitea repository. The risk is increased when pull mirrors are enabled, as scheduled
git fetch --tags operations can continue to follow redirects to collect future internal commits. This may expose sensitive data such as CI/CD secrets, cloud credentials, and production configurations.The issue affects the following endpoints:
POST /repo/migratePOST /api/v1/repos/migrate
Recommendations
- Disable Git HTTP redirects for migration clone and mirror fetch operations by invoking them with the
-c http.followRedirects=falseconfiguration. - Enforce egress restrictions for the Gitea process to block outbound access to loopback, RFC1918, and other internal network ranges.
- Disable repository migrations and pull mirrors if they are not operationally required.
- Restrict migration access to trusted users and disable public self-registration.
- Require authentication on all internal Git HTTP endpoints.
Exploit
Fix
DoS
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitea
Red Os