Executive brief
Gitea, an open-source Git service, is vulnerable to an open redirect flaw. Attackers can craft malicious links that appear to stay within the trusted Gitea domain but instead redirect users to external, potentially harmful websites. This technique is commonly used in phishing campaigns to trick users into providing credentials or downloading malware on a site they believe is legitimate.
Technical details
An open redirect vulnerability (CWE-601) exists in Gitea's URL validation logic within the 'redirect_to' parameter. The application failed to properly sanitize or reject raw backslashes ('\') or percent-encoded backslashes ('%5c'). Because many modern web browsers and URL normalizers treat backslashes as path separators, an attacker can use them to construct scheme-relative URLs (e.g., '/a/../\example.com'). This bypasses relative path checks and forces the browser to redirect to an external domain. The issue is resolved in Gitea version 1.25.5 by tightening relative URL validation to reject these characters.
Affected products
- Gitea Gitea Open Source Git Server <= 1.25.4
Timeline
- 2026-02-17: other: Initial pull request submitted to fix the issue
- 2026-03-13: patched: Gitea version 1.25.5 released
- 2026-07-03: advisory: CVE-2026-25779 published