Most recent entries from all

bdu:2026-10562

EUVD-2026-333749

fkie_cve-2026-25779

Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.

GHSA-j5r2-4c8j-xc3m — Gitea: Open Redirect via redirect_to

Affected: Go: github.com/go-gitea/gitea

### Details

Despite the validation within `urlIsRelative` in `modules/httplib/url.go`, an open redirect is still possible due to usage of directory traversal sequences plus a back-slash in the "redirect_to" parameter.

### PoC

When a user uses this URL to login:

`https://gitea.com/user/login?redirect_to=/a/../\example.com`

They would be redirected to `example.com` upon a successful login to their gitea account.

### Impact

* Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages * OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect * Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header * Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users

WID-SEC-W-2026-0737 — Gitea: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen, einen Denial-of-Service-Zustand auszulösen oder andere, nicht näher spezifizierte Angriffe durchzuführen.