Vulnerability GO-2026-6039
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
2 months ago
July 22, 2026 at 08:36 PM UTC
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev
v0.9.99 - v1.27.0-rc0
v0.9.99 - v1.27.0-rc0
Summary
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev
Details
Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata in gitea.dev
References
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
1 month ago
Gitea: Remote Code Execution via diffpatch Git Hook Installation in gitea.dev
v0.9.99 - v1.27.0 GO-2026-6433
v0.9.99 - v1.27.0 GO-2026-6433
Critical
1 month ago
Gitea: Remote Code Execution via diffpatch Git Hook Installation
v1.17.0 - v1.27.0 GHSA-rcr6-4jqh-j84m
v1.17.0 - v1.27.0 GHSA-rcr6-4jqh-j84m
Unknown
2 months ago
Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev
v0.9.99 - v1.27.0-rc0 GO-2026-6058
v0.9.99 - v1.27.0-rc0 GO-2026-6058
Unknown
2 months ago
Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev
v0.9.99 - v1.27.0-rc0 GO-2026-6059
v0.9.99 - v1.27.0-rc0 GO-2026-6059
Unknown
2 months ago
Gitea: Private Repository Metadata Remains Accessible After Access Revocation in gitea.dev
v0.9.99 - v1.27.0-rc0 GO-2026-6062
v0.9.99 - v1.27.0-rc0 GO-2026-6062
Impacted packages
Timeline
Published
2 months ago
July 22, 2026 at 08:36 PM UTC
Last Modified
4 hours ago
October 14, 2026 at 11:11 AM UTC