Vulnerability advisory

CVE-2019-11229

Published Apr 15, 2019Updated Oct 24, 2026OSV record ↗

Severity

Affected versions

Affected commits	Fixed by commit
GIT github.com/go-gitea/gitea ↗
All commits before bafa9ff4323cef048412157e5f5a7bc516adf985	`bafa9ff4323cef048412157e5f5a7bc516adf985`
3934d9cd2f46bb5240f3c5dd7e7e3423eaa5c339 through 73ce02400cec659bd7a7ee3798ff73a4c7c85957	No fix listed
Not specified	`f64b8eb009dded8be09cbbe4a335311f88c6e525`
Also listed as affected (20) `1.8.0-rc1` `1.8.0-rc2` `v1.7.5` `v1.8.0-rc2` `v1.8.0-rc1` `v1.7.4` `v1.7.3` `v1.7.2` `v1.7.1` `v1.7.0` `v1.7.0-rc3` `v1.7.0-rc2` `v1.7.0-rc1` `v1.6.0-rc1` `v1.6.0-dev` `v1.5.0-rc1` `v1.5.0-dev` `v1.1.0` `v1.0.0` `v0.9.99`

models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to remote code execution.