Executive brief
Gitea is a lightweight Git repository management platform commonly deployed behind reverse proxies. Versions before 1.25.5 fail to properly validate the X-Forwarded-Proto HTTP header, allowing attackers to spoof the canonical URL that Gitea generates. This can lead to phishing attacks, broken redirects, and other security issues that degrade service availability and user trust.
Technical details
This vulnerability exists in Gitea's handling of the X-Forwarded-Proto header (and related headers used by reverse proxies to communicate the original request protocol). The vulnerable code fails to normalize and validate these headers, accepting malformed or multi-valued entries. An attacker can inject or craft malicious forwarded-proto values that bypass validation, causing Gitea to generate spoofed canonical URLs. The attack is network-reachable with no authentication or user interaction required. The fix, released in v1.25.5, restricts X-Forwarded-Proto to accept only "http" or "https" values and ignores any malformed or injected scheme values. Patches are available in commits 723ce35 and e2517e0.
Affected products
- Gitea Gitea < 1.25.5
Timeline
- 2026-07-03: disclosed
- 2026-03-16: patched: v1.25.5 released with fix