CVE-2026-57894

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...

CVE-2026-57894

The Gitea repository management tool is vulnerable to Server-Side Request Forgery (SSRF) via the Clone() function in modules/git/repo.go. The issue arises because the software follows Git HTTP redirects even after initial URL allow/block validation, which can lead to internal git repository exfil...

CVE-2026-57894 Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...

CVE-2026-57894 Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...

CVE-2026-57894

creationtimestamp| type| source ---|---|--- 2026-07-21 20:35:06+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-82f7-87hm-852x...