PT-2026-63315 · Gitea+1 · Gitea+1
CVSS v3.1
7.5
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Gitea (affected versions not specified)
Description
Three code paths bypass the existing Server-Side Request Forgery (SSRF) protections by using raw
http.Get() instead of the validated hostmatcher.NewDialContext() dialer. This allows an attacker to make requests to internal services, scan internal networks (such as 127.0.0.1, 10.x, 172.16-31.x, and 192.168.x), and steal cloud metadata from endpoints like 169.254.169.254 (e.g., AWS IMDSv1 credentials or GCP tokens). Additionally, the use of the file:// scheme in the Open() function enables local file read, potentially exposing sensitive files such as /etc/gitea/app.ini which may contain database credentials and JWT signing secrets.The issue affects the following components:
- The
Open()function inmodules/uri/uri.go. - Release asset and PR patch downloads in
services/migrations/gitea uploader.goandservices/migrations/dump.go. - The
oauth2UpdateAvatarIfNeed()function inrouters/web/auth/oauth.go.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitea
Red Os