-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly names ParseRemoteAddr in modules/auth/repo_form.go as the location of the flaw. The associated pull request (#13525) title 'Disallow urlencoded new lines in git protocol paths if there is a port' indicates this function lacked proper validation for URL-encoded newline characters in paths containing port specifications. This would allow attackers to manipulate git remote addresses through newline injection in URLs, a classic access control bypass scenario (CWE-284). The direct match between CVE description, file path, and function name provides high confidence.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/go-gitea/gitea | go | >= 0.9.99, < 1.12.6 | 1.12.6 |
GoGoOngoing coverage of React2Shell