CVE-2026-57894

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...

CVE-2026-57894 Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...

CVE-2026-57894 Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration...

CVE-2026-57894

CVE-2026-57894 affects Gitea releases around 1.27.x where repository migrations (web/API) can cause internal Git repo exfiltration via HTTP redirects. The reported root cause is that Gitea validates the initially submitted migration URL (allowed by policy) but then delegates the actual clone/fetc...

CVE-2026-57894

creationtimestamp| type| source ---|---|--- 2026-07-21 20:35:06+00:00| published-proof-of-concept| https://github.com/go-gitea/gitea/security/advisories/GHSA-82f7-87hm-852x...