Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | < 1.27.0 | 1.27.0 |
Miggo AIRoot Cause AnalysisThe vulnerability is an SSRF and local file disclosure in Gitea's restore-repo CLI command. When restoring a repository from a dump, Gitea parses pull_request.yml and extracts the Head.CloneURL to add a git remote and fetch from it. To prevent SSRF, Gitea uses CheckAndEnsureSafePR (which relies on hasBaseURL) to ensure the clone URL is safe. However, RepositoryRestorer.GetPullRequests called this check with an empty base URL. Because strings.HasPrefix in Go always returns true for an empty prefix, the safety check was bypassed. The fix involves passing a valid base URL ("file://"+r.baseDir) in restore.go and hardening hasBaseURL in common.go to reject empty base URLs.
RepositoryRestorer.GetPullRequestsservices/migrations/restore.go
hasBaseURLservices/migrations/common.go