Server-Side Request Forgery Vulnerability in Gitea by Go Gitea
CVE-2026-58441

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea Open Source Git Server
Vendor
CVE Published:
13 August 2026

What is CVE-2026-58441?

A server-side request forgery (SSRF) vulnerability exists in Gitea that could allow an attacker to manipulate the system into making unauthorized HTTP requests. This occurs through the unsanitized 'Head.CloneURL' parameter within the 'pull_request.yml' file during the restore-repo process, potentially exposing sensitive information or enabling further attacks if exploited.

Affected Version(s)

Gitea Open Source Git Server 0 <= 1.26.4

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/releases/tag/v1.27.0
release-notes
https://blog.gitea.com/gitea-1.27.0-is-released/
release-notes

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

yoojoon2
.