Executive brief
Gitea, a popular self-hosted Git service, is vulnerable to a security flaw in its repository migration feature. An attacker with a standard user account can bypass security filters to force the Gitea server to connect to internal network resources that should be private. This could allow the attacker to steal sensitive data from internal Git repositories or other private services that are not intended to be accessible from the internet.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Gitea's repository migration logic within `services/migrations/migrate.go`. The validation mechanism incorrectly permits a migration if any resolved IP address for a given hostname is on the allow-list, even if other resolved IPs (such as loopback or private addresses) are blocked. Because the subsequent `git clone` operation performs its own DNS resolution, an attacker can use a multi-answer DNS record or DNS rebinding to bypass pre-flight checks and connect to internal services. This allows authenticated users to exfiltrate data from internal Git repositories or other compatible HTTP endpoints. The issue is addressed in version 1.27.0 by ensuring all resolved IPs are validated.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: disclosed: Initial disclosure in go-gitea/gitea
- 2026-07-21: advisory: GitHub Advisory published
- 2026-07-21: patched: Fix released in version 1.27.0