CVE-2026-25779: Gitea open redirect via backslash-encoded paths in redirect_to parameter

CVE-2026-25779 · Severity: medium · CVSS 4 · Published 2026-07-03

Gitea, an open-source Git service, is vulnerable to an open redirect flaw. Attackers can craft malicious links that appear to stay within the trusted Gitea domain but instead redirect users to external, potentially harmful websites. This technique is commonly used in phishing campaigns to trick users into providing credentials or downloading malware on a site they believe is legitimate.

Technologies: Gitea, code.gitea.io/gitea (Go), github.com/go-gitea/gitea (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-25779 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-25779 being exploited in the wild.
How severe is CVE-2026-25779?
Medium severity, with a CVSS score of 4, published 3 July 2026.
Which products and versions are affected?
Gitea <= 1.25.4; code.gitea.io/gitea (Go) SEMVER:introduced=0,fixed=1.26.0; github.com/go-gitea/gitea (Go) <= 1.25.4, SEMVER:introduced=0,fixed=1.26.0.
Is there a fix for CVE-2026-25779?
Yes. code.gitea.io/gitea (Go): upgrade to 1.26.0 or later; github.com/go-gitea/gitea (Go): upgrade to 1.26.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25779 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-25779?
Check whether you run Gitea, code.gitea.io/gitea (Go) or github.com/go-gitea/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • code.gitea.io/gitea (Go): upgrade to 1.26.0 or later
    go get code.gitea.io/gitea@v1.26.0
  • github.com/go-gitea/gitea (Go): upgrade to 1.26.0 or later
    go get github.com/go-gitea/gitea@v1.26.0

Technical details

An open redirect vulnerability (CWE-601) exists in Gitea's URL validation logic within the 'redirect_to' parameter. The application failed to properly sanitize or reject raw backslashes ('\') or percent-encoded backslashes ('%5c'). Because many modern web browsers and URL normalizers treat backslashes as path separators, an attacker can use them to construct scheme-relative URLs (e.g., '/a/../\example.com'). This bypasses relative path checks and forces the browser to redirect to an external domain. The issue is resolved in Gitea version 1.25.5 by tightening relative URL validation to reject these characters.

Affected products

  • Gitea Gitea Open Source Git Server <= 1.25.4

Identifiers

  • CVE-2026-25779
  • GHSA-j5r2-4c8j-xc3m
  • GO-2026-5448

Timeline

  • 2026-02-17: other: Initial pull request submitted to fix the issue
  • 2026-03-13: patched: Gitea version 1.25.5 released
  • 2026-07-03: advisory: CVE-2026-25779 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.