CVE-2026-59765 SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata...

CVE-2026-59765

CVE-2026-59765 is a Gitea SSRF vulnerability: prior to version 1.27.0, the Migration Asset Downloads path can bypass hostmatcher, enabling server-side requests that reach internal files and cloud metadata. Root cause involves how migration/OAuth paths perform HTTP fetches (Go http.Get usage) allo...

GO-2026-6039 Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev

Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev...