Description
SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
Published: 2026-08-13
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A Server Side Request Forgery flaw in the Migration Asset Downloads feature of the Gitea Open Source Git Server allows an attacker to supply arbitrary URLs. Because the hostmatcher validation is bypassed, Gitea can reach internal network resources and cloud metadata endpoints, exposing sensitive files, configuration data, and credentials. This can lead to confidential data disclosure and, if secrets are obtained, enable further compromise.

Affected Systems

The vulnerability exists in all Gitea releases that support migration asset downloads prior to the fix shipped in version 1.27.0. Any deployment of those earlier releases exposed to external users or integration points is affected.

Risk and Exploitability

The CVSS score is 7.5, indicating high severity risk. The EPSS score is <1%, suggesting a low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, the attacker would need to initiate a migration asset download request with a crafted URL, typically via an API or webhook that has permission to trigger migrations. Such a request would allow the server to retrieve arbitrary internal resources.

Generated by OpenCVE AI on August 14, 2026 at 20:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update Gitea to version 1.27.0 or later, which patches the SSRF flaw.
  • Restrict or disable the migration asset download feature for untrusted users, or limit its access to privileged roles only.
  • Configure strict host validation or block internal domains on the hostmatcher, even though the bug bypasses it, to reduce the attack surface.
  • Monitor logs for unexpected migration download requests and block traffic from unknown IP addresses at the network or application level.

Generated by OpenCVE AI on August 14, 2026 at 20:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-2wm4-vwp6-v7xc Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
History

Sat, 15 Aug 2026 01:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 14 Aug 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

Thu, 13 Aug 2026 19:15:00 +0000

Type Values Removed Values Added
First Time appeared Gitea
Gitea gitea Open Source Git Server
Vendors & Products Gitea
Gitea gitea Open Source Git Server

Thu, 13 Aug 2026 17:00:00 +0000

Type Values Removed Values Added
Description SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
Title SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata
Weaknesses CWE-918
References

Subscriptions

Gitea Gitea Open Source Git Server
cve-icon MITRE

Status: PUBLISHED

Assigner: Gitea

Published:

Updated: 2026-08-14T19:01:54.065Z

Reserved: 2026-07-08T09:19:07.995Z

Link: CVE-2026-59765

cve-icon Vulnrichment

Updated: 2026-08-14T19:01:49.911Z

cve-icon NVD

Status : Deferred

Published: 2026-08-13T17:17:30.493

Modified: 2026-08-26T16:53:48.300

Link: CVE-2026-59765

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-14T20:45:03Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)