https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 05:58:53 +0000 https://db.gcve.eu/vuln/cve-2026-59765 <p><strong>Affected:</strong> Gitea Open Source Git Server</p> <p>SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata</p> <p><strong>Affected:</strong> Gitea Open Source Git Server</p> <p>SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata</p> https://db.gcve.eu/vuln/cve-2026-59765 https://db.gcve.eu/vuln/ghsa-2wm4-vwp6-v7xc <p><strong>Affected:</strong> Go: code.gitea.io/gitea, Go: gitea.dev</p> <p>### Summary</p> <p>Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw `http.Get()` (Go&#39;s `DefaultClient`) which completely bypasses this protection, enabling SSRF to internal services and local file read via the `file://` scheme.</p> <p>### Vulnerable Code</p> <p>**File: `modules/uri/uri.go` (line 32) -- Core vulnerability**</p> <p>```go func Open(uriStr string) (io.ReadCloser, error) { u, err := url.Parse(uriStr) switch strings.ToLower(u.Scheme) { case &#34;http&#34;, &#34;https&#34;: f, err := http.Get(uriStr) // RAW http.Get -- no hostmatcher filtering return f.Body, nil case &#34;file&#34;: return os.Open(u.Path) // LOCAL FILE READ via file:// scheme } } ```</p> <p>**Callers in migration path:** - `services/migrations/gitea_uploader.go:340` -- `uri.Open(*asset.DownloadURL)` for release assets - `services/migrations/gitea_uploader.go:586` -- `uri.Open(pr.PatchURL)` for PR patches</p> <p>**File: `services/migrations/dump.go` (lines 312, 453)**</p> <p>```go // Line 312 -- release asset download resp, err := http.Get(*asset.DownloadURL)</p> <p>// Line 453 -- PR patch download (with self-documenting TODO) resp, err := http.Get(u) // TODO: This probably needs to use the downloader ```</p> <p>**File: `routers/web/auth/oauth.go` (line 306)**</p> <p>```go func oauth2UpdateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) { resp, err := http.Get(url)…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea, Go: gitea.dev</p> <p>### Summary</p> <p>Gitea has robust SSRF protection via `hostmatcher.NewDialContext()` for webhook and migration clone URLs, which validates resolved IPs at the TCP dial level. However, three code paths use raw `http.Get()` (Go&#39;s `DefaultClient`) which completely bypasses this protection, enabling SSRF to internal services and local file read via the `file://` scheme.</p> <p>### Vulnerable Code</p> <p>**File: `modules/uri/uri.go` (line 32) -- Core vulnerability**</p> <p>```go func Open(uriStr string) (io.ReadCloser, error) { u, err := url.Parse(uriStr) switch strings.ToLower(u.Scheme) { case &#34;http&#34;, &#34;https&#34;: f, err := http.Get(uriStr) // RAW http.Get -- no hostmatcher filtering return f.Body, nil case &#34;file&#34;: return os.Open(u.Path) // LOCAL FILE READ via file:// scheme } } ```</p> <p>**Callers in migration path:** - `services/migrations/gitea_uploader.go:340` -- `uri.Open(*asset.DownloadURL)` for release assets - `services/migrations/gitea_uploader.go:586` -- `uri.Open(pr.PatchURL)` for PR patches</p> <p>**File: `services/migrations/dump.go` (lines 312, 453)**</p> <p>```go // Line 312 -- release asset download resp, err := http.Get(*asset.DownloadURL)</p> <p>// Line 453 -- PR patch download (with self-documenting TODO) resp, err := http.Get(u) // TODO: This probably needs to use the downloader ```</p> <p>**File: `routers/web/auth/oauth.go` (line 306)**</p> <p>```go func oauth2UpdateAvatarIfNeed(ctx *context.Context, url string, u *user_model.User) { resp, err := http.Get(url)…</p> https://db.gcve.eu/vuln/ghsa-2wm4-vwp6-v7xc