PT-2026-63315

CVE-2026-59765

Published

2026-07-13

Updated

2026-10-14

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description Three code paths bypass the existing Server-Side Request Forgery (SSRF) protections by using raw http.Get() instead of the validated hostmatcher.NewDialContext() dialer. This allows an attacker to make requests to internal services, scan internal networks (such as 127.0.0.1, 10.x, 172.16-31.x, and 192.168.x), and steal cloud metadata from endpoints like 169.254.169.254 (e.g., AWS IMDSv1 credentials or GCP tokens). Additionally, the use of the file:// scheme in the Open() function enables local file read, potentially exposing sensitive files such as /etc/gitea/app.ini which may contain database credentials and JWT signing secrets.

The issue affects the following components:

The Open() function in modules/uri/uri.go.
Release asset and PR patch downloads in services/migrations/gitea uploader.go and services/migrations/dump.go.
The oauth2UpdateAvatarIfNeed() function in routers/web/auth/oauth.go.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers