A user who creates a repository migration or pull mirror can supply a hostname that returns multiple DNS answers. The server validates the first IP address resolved but later connects to a different address selected by the Git client, allowing the attacker to join internal network resources. This flaw is a classic Server‑Side Request Forgery (CWE‑918) that permits reading and writing to reachable internal Git or HTTP endpoints. The error messages generated during migration or mirroring can leak the content of internal responses, providing additional information to the attacker.

Version information was not provided in the CVE payload, so the specific affected releases are unknown. The vulnerability applies to all installations of Gitea that contain the repository migration and pull mirror functionality prior to the application of a fix. Administrators should verify whether their instance includes the vulnerable code by checking the vendor’s release notes or security advisories.

The flaw is exploitable by any low‑privileged user with access to initiate migrations or mirrors. The CVSS score is 4.3, indicating a moderate impact. The EPSS score of 0.00124 indicates a low, yet non‑zero, probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. The impact on internal data confidentiality and integrity can be severe. The server‑side process can reach internal services, exfiltrate data, or modify repository contents, potentially disrupting internal Git operations or web services.