Gitea performs an initial validation of remote URLs for push mirrors, wiki remote checks, and fetches of migrated pull request heads, but after following HTTP redirects it does not revalidate the final destination. This allows an administrator to configure a redirecting endpoint that, once followed, causes Gitea's internal Git client to issue requests to arbitrary hosts that would normally be blocked by the server’s outbound policy. The result is a server‑side request forgery that can expose internal network resources or reach otherwise unreachable services.

Products affected are those built on the Gitea code base. The CVE entry identifies Gitea:Gitea as the vendor/product. No specific version range is supplied within the public data, so any installation running a pre‑patched version of Gitea is potentially vulnerable. The fix is referenced in release v28.0.0, implying earlier releases carry the flaw.

The vulnerability carries a CWE‑918 designation and would be leveraged through a redirection chain from a controlled endpoint. The EPSS score of < 1% indicates a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. However, if the environment allows outbound traffic to internal hosts, a vulnerable Gitea instance could use the redirect to access otherwise blocked services. The impact then depends on the server’s network reachability; if internal networks are reachable, attackers can query internal services; otherwise the damage is limited to the redirect target. Mitigation requires patching or blocking the redirect flow.