Executive brief
Gitea, a popular self-hosted Git service, contains a security flaw that allows administrators or organization owners to bypass internal network protections. By initiating a repository migration from a malicious source, an attacker can trick the Gitea server into accessing internal services, reading sensitive local configuration files (like database credentials), or stealing cloud metadata tokens. This could lead to a full compromise of the server or the underlying cloud infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Gitea due to the use of Go's raw 'http.Get' (DefaultClient) in specific code paths, bypassing the 'hostmatcher.NewDialContext' protection used elsewhere. The vulnerable paths include release asset and PR patch downloads during repository migrations, as well as avatar updates in OAuth2 flows. Because 'modules/uri/uri.go' supports the 'file://' scheme without validation, an attacker can achieve local file read (e.g., 'app.ini'). Additionally, the lack of IP filtering allows requests to internal loopback addresses and cloud metadata endpoints (e.g., AWS IMDS). Exploitation requires migration permissions (Admin/Org Owner) or a custom OAuth2 configuration. The issue is fixed in version 1.27.0.
Affected products
- Gitea Gitea < 1.27.0
Timeline
- 2026-07-13: disclosed: Initial disclosure to vendor
- 2026-07-21: advisory: GitHub Advisory published
- 2026-07-21: patched: Fix released in version 1.27.0