Local File Inclusion in Gitea by go-gitea via file:// URI
CVE-2026-58420

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea Open Source Git Server
Vendor
CVE Published:
13 August 2026

What is CVE-2026-58420?

A local file inclusion vulnerability exists in Gitea due to improper handling of file:// URIs during migration restore operations. This flaw could allow an attacker to access sensitive files on the server, potentially leading to unauthorized data exposure.

Affected Version(s)

Gitea Open Source Git Server 0 <= 1.26.4

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/releases/tag/v1.27.0
release-notes
https://blog.gitea.com/gitea-1.27.0-is-released/
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

isa0-gh
ibrahmsql
.