CVE-2026-58441

Name of the Vulnerable Software and Affected Versions Gitea versions 1.26.4 and earlier

Description The restore-repo CLI command fails to properly validate the Head.CloneURL field when parsing pull request.yml from a repository dump. The safety check function CheckAndEnsureSafePR() is called with an empty commonCloneBaseURL variable, which effectively disables the validation. This allows a malicious dump file to force the Gitea server to execute a git fetch command against an attacker-specified URL. This can lead to Server-Side Request Forgery (SSRF) against internal services or cloud metadata endpoints, or the disclosure of local git repositories using the file:// protocol.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.