A Server Side Request Forgery flaw in the Migration Asset Downloads feature of the Gitea Open Source Git Server allows an attacker to supply arbitrary URLs. Because the hostmatcher validation is bypassed, Gitea can reach internal network resources and cloud metadata endpoints, exposing sensitive files, configuration data, and credentials. This can lead to confidential data disclosure and, if secrets are obtained, enable further compromise.

The vulnerability exists in all Gitea releases that support migration asset downloads prior to the fix shipped in version 1.27.0. Any deployment of those earlier releases exposed to external users or integration points is affected.

The CVSS score is not publicly listed, but the ability to read internal files through SSRF indicates a high severity risk. EPSS is not available and the issue is not in the CISA KEV catalog. Based on the description, the attacker would need to initiate a migration asset download request with a crafted URL, typically via an API or webhook that has permission to trigger migrations. Such a request would allow the server to retrieve arbitrary internal resources.