https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 11:40:05 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-13682 bdu:2026-13682 https://cve.radiocsirt.org/vuln/bdu:2026-13682 https://cve.radiocsirt.org/vuln/euvd-2026-333346 EUVD-2026-333346 https://cve.radiocsirt.org/vuln/euvd-2026-333346 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58418 <p>SSRF via HTTP Redirect in Repository Migration</p> <p>SSRF via HTTP Redirect in Repository Migration</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58418 https://cve.radiocsirt.org/vuln/ghsa-rqhx-647v-wx32 <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>Gitea 1.25.4 validates the initial URL provided to the repository migration endpoint (`POST /api/v1/repos/migrate`) and correctly blocks requests to internal addresses like `127.0.0.1` or RFC1918 ranges. However, if the initial URL points to an attacker-controlled server that responds with an HTTP 302 redirect to an internal address, Gitea follows the redirect without performing a second validation. This allows a low-privilege user to reach internal services through Gitea as a proxy.</p> <p>## Affected Version</p> <p>Gitea 1.25.4 (latest stable at time of writing), default configuration.</p> <p>## Prerequisites</p> <p>1. A regular Gitea user account (no admin privileges required) 2. An attacker-controlled server reachable from the internet that serves HTTP 302 redirects</p> <p>## Reproduction</p> <p>### Environment</p> <p>| Role | Location | Network | |------------------|----------------------------------------------------------------|------------------------------------------| | Attacker | Any machine with internet access | External network (VLAN A) | | Gitea Server | Windows 11 VM, Gitea 1.25.4, default config, SQLite | Internal network (VLAN B) | | Internal service | Same VM, bound to `127.0.0.1:18082` | Localhost only | | Redirect server | Attacker-controlled public serv…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>## Summary</p> <p>Gitea 1.25.4 validates the initial URL provided to the repository migration endpoint (`POST /api/v1/repos/migrate`) and correctly blocks requests to internal addresses like `127.0.0.1` or RFC1918 ranges. However, if the initial URL points to an attacker-controlled server that responds with an HTTP 302 redirect to an internal address, Gitea follows the redirect without performing a second validation. This allows a low-privilege user to reach internal services through Gitea as a proxy.</p> <p>## Affected Version</p> <p>Gitea 1.25.4 (latest stable at time of writing), default configuration.</p> <p>## Prerequisites</p> <p>1. A regular Gitea user account (no admin privileges required) 2. An attacker-controlled server reachable from the internet that serves HTTP 302 redirects</p> <p>## Reproduction</p> <p>### Environment</p> <p>| Role | Location | Network | |------------------|----------------------------------------------------------------|------------------------------------------| | Attacker | Any machine with internet access | External network (VLAN A) | | Gitea Server | Windows 11 VM, Gitea 1.25.4, default config, SQLite | Internal network (VLAN B) | | Internal service | Same VM, bound to `127.0.0.1:18082` | Localhost only | | Redirect server | Attacker-controlled public serv…</p> https://cve.radiocsirt.org/vuln/ghsa-rqhx-647v-wx32 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149