https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 12:30:02 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-58441 <p>SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL</p> <p>SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-58441 https://vulnerability.circl.lu/vuln/ghsa-xmj7-xj85-hfc3 <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary Gitea&#39;s `restore-repo` CLI command restores a repository from a dump directory/archive. When parsing `pull_request.yml` from that dump, the `Head.CloneURL` field is used to add a git remote and fetch from it with no validation, because the safety check that&#39;s supposed to guard it (`CheckAndEnsureSafePR`) is called with an empty `commonCloneBaseURL`, which silently disables it. This lets a malicious dump make the Gitea server execute `git fetch` against an attacker-chosen URL (SSRF), or disclose a local git repository via `file://`. This is a different root cause from the recently fixed path-traversal issue in the same command (#38215), which patched `DownloadURL`/`PatchURL` but not `Head.CloneURL`.</p> <p>### Details `services/migrations/restore.go`&#39;s `GetPullRequests()` unmarshals `pull_request.yml` directly into `base.PullRequest` structs with no validation of `Head.CloneURL`:</p> <p>```go err = yaml.Unmarshal(bs, &amp;pulls) ... for _, pr := range pulls { if pr.PatchURL != &#34;&#34; { pr.PatchURL = &#34;file://&#34; + util.FilePathJoinAbs(r.baseDir, pr.PatchURL) } CheckAndEnsureSafePR(pr, &#34;&#34;, r) // &lt;-- empty baseURL } ```</p> <p>`CheckAndEnsureSafePR` (`services/migrations/common.go`) is supposed to reject `Head.CloneURL`/`PatchURL` values that don&#39;t share a common base URL:</p> <p>```go func hasBaseURL(toCheck, baseURL string) bool { if len(baseURL) &gt; 0 &amp;&amp; baseURL[len(baseURL)-1] != &#39;/&#39; { baseURL += &#34;/&#34; } return strings.HasPrefix(toCheck, baseURL) }</p> <p>func Chec…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>### Summary Gitea&#39;s `restore-repo` CLI command restores a repository from a dump directory/archive. When parsing `pull_request.yml` from that dump, the `Head.CloneURL` field is used to add a git remote and fetch from it with no validation, because the safety check that&#39;s supposed to guard it (`CheckAndEnsureSafePR`) is called with an empty `commonCloneBaseURL`, which silently disables it. This lets a malicious dump make the Gitea server execute `git fetch` against an attacker-chosen URL (SSRF), or disclose a local git repository via `file://`. This is a different root cause from the recently fixed path-traversal issue in the same command (#38215), which patched `DownloadURL`/`PatchURL` but not `Head.CloneURL`.</p> <p>### Details `services/migrations/restore.go`&#39;s `GetPullRequests()` unmarshals `pull_request.yml` directly into `base.PullRequest` structs with no validation of `Head.CloneURL`:</p> <p>```go err = yaml.Unmarshal(bs, &amp;pulls) ... for _, pr := range pulls { if pr.PatchURL != &#34;&#34; { pr.PatchURL = &#34;file://&#34; + util.FilePathJoinAbs(r.baseDir, pr.PatchURL) } CheckAndEnsureSafePR(pr, &#34;&#34;, r) // &lt;-- empty baseURL } ```</p> <p>`CheckAndEnsureSafePR` (`services/migrations/common.go`) is supposed to reject `Head.CloneURL`/`PatchURL` values that don&#39;t share a common base URL:</p> <p>```go func hasBaseURL(toCheck, baseURL string) bool { if len(baseURL) &gt; 0 &amp;&amp; baseURL[len(baseURL)-1] != &#39;/&#39; { baseURL += &#34;/&#34; } return strings.HasPrefix(toCheck, baseURL) }</p> <p>func Chec…</p> https://vulnerability.circl.lu/vuln/ghsa-xmj7-xj85-hfc3