CVE-2026-59765: Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

July 21, 2026

Gitea has robust SSRF protection via hostmatcher.NewDialContext() for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw http.Get() (Go’s DefaultClient) which completely bypasses this protection, enabling SSRF to internal services and local file read via the file:// scheme.

References

github.com/advisories/GHSA-2wm4-vwp6-v7xc
github.com/go-gitea/gitea/releases/tag/v1.27.0
github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc
nvd.nist.gov/vuln/detail/CVE-2026-59765

Code Behaviors & Features

Detect and mitigate CVE-2026-59765 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →