CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

CVE-2026-58441

Gitea is affected by a Server-Side Request Forgery (SSRF) vulnerability within the restore-repo functionality. The root cause is the handling of unsanitized Head.CloneURL data in pull_request.yml files, which could allow an attacker to trigger unintended requests from the server. To remediate thi...

CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

SUSE CVE-2026-58441

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

Improper Validation

code.gitea.io/gitea is vulnerable to Improper Validation. The vulnerability exists because Migration Downloaders can change the CloneURL which is improperly validated, allowing an attacker to redirect users to a malicious clone URL...

gitea -- multiple issues

The Gitea team reports: Double check CloneURL is acceptable Add more checks in migration code...