CVE-2026-59765: SSRF via Migration Asset Downloads Bypasses hostmatcher , Reads Internal Files and Cloud Metadata

CVE-2026-59765 · Severity: high · CVSS 7.5 · Published 2026-08-13

Gitea, a popular self-hosted Git service, contains a security flaw that allows administrators or organization owners to bypass internal network protections. By initiating a repository migration from a malicious source, an attacker can trick the Gitea server into accessing internal services, reading sensitive local configuration files (like database credentials), or stealing cloud metadata tokens. This could lead to a full compromise of the server or the underlying cloud infrastructure.

Technologies: Gitea, code.gitea.io/gitea (Go). Vendors: Gitea, Go.

Quick answers

Is CVE-2026-59765 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-59765 being exploited in the wild.
How severe is CVE-2026-59765?
High severity, with a CVSS score of 7.5, published 13 August 2026.
Which products and versions are affected?
Gitea < 1.27.0; code.gitea.io/gitea (Go) < 1.27.0.
Is there a fix for CVE-2026-59765?
A patch was published on 2026-07-21: Fix released in version 1.27.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59765 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-59765?
Check whether you run Gitea or code.gitea.io/gitea (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in Gitea due to the use of Go's raw 'http.Get' (DefaultClient) in specific code paths, bypassing the 'hostmatcher.NewDialContext' protection used elsewhere. The vulnerable paths include release asset and PR patch downloads during repository migrations, as well as avatar updates in OAuth2 flows. Because 'modules/uri/uri.go' supports the 'file://' scheme without validation, an attacker can achieve local file read (e.g., 'app.ini'). Additionally, the lack of IP filtering allows requests to internal loopback addresses and cloud metadata endpoints (e.g., AWS IMDS). Exploitation requires migration permissions (Admin/Org Owner) or a custom OAuth2 configuration. The issue is fixed in version 1.27.0.

Affected products

  • Gitea Gitea < 1.27.0

Identifiers

  • CVE-2026-59765
  • GHSA-2wm4-vwp6-v7xc

Timeline

  • 2026-07-13: disclosed: Initial disclosure to vendor
  • 2026-07-21: advisory: GitHub Advisory published
  • 2026-07-21: patched: Fix released in version 1.27.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.