Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions the urlIsRelative function in modules/httplib/url.go as the source of the open redirect vulnerability. To confirm this and identify the exact vulnerable code, I first identified the patched version (1.26.0) and the last vulnerable version (1.25.4) from the advisory. By comparing the commits between these two versions, I located the security patch with the commit message "Prevent redirect bypasses via backslash-encoded paths (#36660)". Analyzing this commit's diff revealed changes in modules/httplib/url.go within the urlIsRelative function. The patch adds a check to disallow backslashes in the URL path, and the accompanying comment clearly explains how the lack of this check led to an open redirect. This provides direct evidence of the vulnerability within the identified function.
httplib.urlIsRelativemodules/httplib/url.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/go-gitea/gitea | go | <= 1.25.4 | 1.26.0 |