Vulnerability advisory
GO-2026-6039
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev
Also known as BIT-gitea-2026-34966CVE-2026-34966CVE-2026-59765GHSA-2wm4-vwp6-v7xc
Severity
Severity not reported.
Affected versions
gitea.dev Go
| Affected | Fixed in |
|---|---|
| All versions before 1.27.0 | 1.27.0 |
Description
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev