CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

CVE-2026-58441

CVE-2026-58441 describes SSRF in Gitea's restore-repo flow when parsing pull_request.yml. The issue arises because Head.CloneURL is not validated due to CheckAndEnsureSafePR being called with an empty commonCloneBaseURL, letting an attacker-controlled URL survive and be used to add a git remote a...

CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

Improper Validation

code.gitea.io/gitea is vulnerable to Improper Validation. The vulnerability exists because Migration Downloaders can change the CloneURL which is improperly validated, allowing an attacker to redirect users to a malicious clone URL...

gitea -- multiple issues

The Gitea team reports: Double check CloneURL is acceptable Add more checks in migration code...