CVE-2026-58441

A Server-Side Request Forgery (SSRF) vulnerability exists in Gitea within the restore-repo functionality. The root cause is the processing of an unsanitized pull_request.yml Head.CloneURL parameter. This vulnerability was addressed in Gitea version 1.27.0 . Specific exploit details are not provid...

CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

CVE-2026-58441 SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

SUSE CVE-2026-58441

SSRF in restore-repo via unsanitized pullrequest.yml Head.CloneURL...

PT-2026-65381

Gitea: SSRF in restore-repo via unsanitized pull request.yml Head.CloneURL in gitea.dev...

Improper Validation

code.gitea.io/gitea is vulnerable to Improper Validation. The vulnerability exists because Migration Downloaders can change the CloneURL which is improperly validated, allowing an attacker to redirect users to a malicious clone URL...

gitea -- multiple issues

The Gitea team reports: Double check CloneURL is acceptable Add more checks in migration code...