Executive brief
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev
Affected products
- Go code.gitea.io/gitea
- Go gitea.dev
CVE identifiers
- CVE-2026-59765
- CVE-2026-34966
Junglewise Threat Intelligence
CVE-2026-59765: GO-2026-6039 - Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata in gitea.dev
CVE-2026-59765 · Severity: low · CVSS 3.1 · Published 2026-07-22
Technologies: code.gitea.io/gitea (Go), gitea.dev (Go). Vendors: Go.
Related threats
- Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- GO-2026-6074 - Gitea: API Fork Endpoint Authorization Bypass Allows Organization Members to Bypass Repository Creation Restrictions in code.gitea.io/gitea
- Gitea public-only token scope bypass in Organization and Permission endpoints
- Gitea SSRF and local file read via migration asset bypass
- Gitea plaintext webhook authorization header exposure in API