Gitea’s migration restore routine accepts a file:// URI, allowing a local file inclusion (CWE‑284). This flaw can enable an attacker to read arbitrary files on the host or, if an inclusion endpoint is exploitable, execute arbitrary code. The impact is a compromise of confidentiality, integrity and possibly availability of the affected instance.

The vulnerability is present in Gitea Open Source Git Server, though specific affected versions are not listed in the data. It applies to installations that expose the migration restore functionality.

The EPSS score of 0.00302, well below 1%, indicates a very low probability of exploitation and is not listed in the CISA KEV catalog, implying limited publicly known exploitation. The likely attack vector is that an authenticated user with migration privileges can supply a file:// URI; thus the exploitation likelihood depends on who can access the feature. The CVSS score of 4.4 indicates moderate risk, but local file inclusion is still a significant weakness.