Skip to content
OpenAdvisories
Medium WID-SEC-2026-2678 2 CVEs

Gitea: Mehrere Schwachstellen ermöglichen Offenlegung von Informationen

Published Aug 5, 2026 · Updated Aug 13, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Informationen offenzulegen.

Product

Gitea ist ein quelloffener Github-Klon.

Vulnerabilities 2

  • High 7.6
    CVE-2026-34966

    Gitea prior to 1.27.0 SSRF via Migration URI Fetch Bypass

    Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without a cus…

    Gitea Gitea code.gitea.io/gitea gitea.dev Go
  • High 7.5
    CVE-2026-59765

    SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

    SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata

    Gitea Gitea Open Source Git Server

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-58126

  2. #1

    Initiale Fassung

References