Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a Local File Inclusion (LFI) in Gitea's repository restoration functionality. The root cause is the use of filepath.Join to construct file paths from user-controlled data in release.yml and pull_request.yml files within a backup archive. An attacker can use path traversal sequences (e.g., ../../) in the download_url or patch_url fields to access files outside of the intended backup directory.
The identified vulnerable functions, RepositoryRestorer.GetReleases and RepositoryRestorer.GetPullRequests in services/migrations/restore.go, are directly responsible for processing these malicious paths. The fix, identified in commit d5e6f273f06292492bd9fb56ca02d111dab5ab66, replaces the vulnerable filepath.Join with util.FilePathJoinAbs, which correctly sanitizes the path and prevents traversal, thus mitigating the vulnerability. Although the advisory mentions gitea_uploader.go, the identified commit in restore.go directly addresses the described LFI vulnerability during repository restoration.
RepositoryRestorer.GetReleasesservices/migrations/restore.go
RepositoryRestorer.GetPullRequestsservices/migrations/restore.go
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gitea.dev | go | < 1.27.0 | 1.27.0 |