CVE-2026-58441

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

6.3 MediumFix available

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

0.17%Unchanged since Aug 14, 2026

What each source reports

CVE List Score used 6.3

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Record: CVE-2026-58441
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2026-58168 6.3

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Record: EUVD-2026-58168
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-xmj7-xj85-hfc3 6.3

Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Summary

Gitea's restore-repo CLI command restores a repository from a dump directory/archive. When parsing pull_request.yml from that dump, the Head.CloneURL field is used to add a git remote and fetch from it with no validation, because the safety check that's supposed to guard it (CheckAndEnsureSafePR) is called with an empty commonCloneBaseURL, which silently disables it. This lets a malicious dump make the Gitea server execute git fetch against an attacker-chosen URL (SSRF), or disclose a local git repository via file://. This is a different root cause from the recently fixed path-traversal issue in the same command (#38215), which patched DownloadURL/PatchURL but not Head.CloneURL.

Details

services/migrations/restore.go's GetPullRequests() unmarshals pull_request.yml directly into base.PullRequest structs with no validation of Head.CloneURL:

err = yaml.Unmarshal(bs, &pulls)
...
for _, pr := range pulls {
    if pr.PatchURL != "" {
        pr.PatchURL = "file://" + util.FilePathJoinAbs(r.baseDir, pr.PatchURL)
    }
    CheckAndEnsureSafePR(pr, "", r)   // <-- empty baseURL
}

CheckAndEnsureSafePR (services/migrations/common.go) is supposed to reject Head.CloneURL/PatchURL values that don't share a common base URL:

func hasBaseURL(toCheck, baseURL string) bool {
    if len(baseURL) > 0 && baseURL[len(baseURL)-1] != '/' {
        baseURL += "/"
    }
    return strings.HasPrefix(toCheck, baseURL)
}

func CheckAndEnsureSafePR(pr *base.PullRequest, commonCloneBaseURL string, g base.Downloader) bool {
    valid := true
    if pr.PatchURL != "" && !hasBaseURL(pr.PatchURL, commonCloneBaseURL) {
        pr.PatchURL = ""
        valid = false
    }
    if pr.Head.CloneURL != "" && !hasBaseURL(pr.Head.CloneURL, commonCloneBaseURL) {
        pr.Head.CloneURL = ""
        valid = false
    }
    return valid
}

strings.HasPrefix(anything, "") is always true in Go. Because restore.go is the only caller that passes "" as commonCloneBaseURL, this check is a complete no-op on the restore-repo path — Head.CloneURL survives unchanged regardless of its value. Every other downloader (github.go, gitlab.go, gitea_downloader.go, codebase.go, codecommit.go, onedev.go) passes a real base URL, so they are not affected.

services/migrations/gitea_uploader.go then uses the unvalidated value directly:

err := g.gitRepo.AddRemote(remote, pr.Head.CloneURL, true)
// ... later: fetch from that remote

resulting in the server executing git fetch against an attacker-controlled URL sourced from the dump file.

RCE via git's ext:: transport helper was tested and ruled out — a normal git install rejects it by default (fatal: transport 'ext' not allowed), independent of Gitea's own configuration. This report is scoped to SSRF and local git-repository disclosure.

Confirmed present, byte-for-byte identical, in v1.26.4 (latest stable tag), release/v1.27, and main, by direct checkout and diff.

PoC

Create a dump directory following the normal restore-repo layout (repo.yml, etc.), and add a pull_request.yml containing at least one entry with:

   - number: 1
     head:
       cloneURL: "http://<attacker-controlled-or-internal-host>:<port>/ssrf-proof"
       ref: "main"

Run gitea restore-repo against that dump directory for any repo owner.
Observe on the target host/listener: an actual git HTTP discovery request arrives, e.g. GET /ssrf-proof/info/refs?service=git-upload-pack, driven entirely by the value from the dump file.

Verified the core mechanism (steps 2–3, i.e. the unvalidated Head.CloneURL surviving CheckAndEnsureSafePR("") and then being used in a real git remote add + git fetch) with a minimal, standalone Go program built from the verbatim, unmodified hasBaseURL / CheckAndEnsureSafePR function bodies (attached: gitea_ssrf_poc.go), run end-to-end against a…

Record: GHSA-xmj7-xj85-hfc3
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 6.3

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Record: CVE-2026-58441
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSV 6.3

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Record: CVE-2026-58441
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSVGHSA-xmj7-xj85-hfc3 6.3

Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL

Summary

Details

services/migrations/restore.go's GetPullRequests() unmarshals pull_request.yml directly into base.PullRequest structs with no validation of Head.CloneURL:

err = yaml.Unmarshal(bs, &pulls)
...
for _, pr := range pulls {
    if pr.PatchURL != "" {
        pr.PatchURL = "file://" + util.FilePathJoinAbs(r.baseDir, pr.PatchURL)
    }
    CheckAndEnsureSafePR(pr, "", r)   // <-- empty baseURL
}

CheckAndEnsureSafePR (services/migrations/common.go) is supposed to reject Head.CloneURL/PatchURL values that don't share a common base URL:

func hasBaseURL(toCheck, baseURL string) bool {
    if len(baseURL) > 0 && baseURL[len(baseURL)-1] != '/' {
        baseURL += "/"
    }
    return strings.HasPrefix(toCheck, baseURL)
}

func CheckAndEnsureSafePR(pr *base.PullRequest, commonCloneBaseURL string, g base.Downloader) bool {
    valid := true
    if pr.PatchURL != "" && !hasBaseURL(pr.PatchURL, commonCloneBaseURL) {
        pr.PatchURL = ""
        valid = false
    }
    if pr.Head.CloneURL != "" && !hasBaseURL(pr.Head.CloneURL, commonCloneBaseURL) {
        pr.Head.CloneURL = ""
        valid = false
    }
    return valid
}

services/migrations/gitea_uploader.go then uses the unvalidated value directly:

err := g.gitRepo.AddRemote(remote, pr.Head.CloneURL, true)
// ... later: fetch from that remote

resulting in the server executing git fetch against an attacker-controlled URL sourced from the dump file.

Confirmed present, byte-for-byte identical, in v1.26.4 (latest stable tag), release/v1.27, and main, by direct checkout and diff.

PoC

Create a dump directory following the normal restore-repo layout (repo.yml, etc.), and add a pull_request.yml containing at least one entry with:

   - number: 1
     head:
       cloneURL: "http://<attacker-controlled-or-internal-host>:<port>/ssrf-proof"
       ref: "main"

Run gitea restore-repo against that dump directory for any repo owner.
Observe on the target host/listener: an actual git HTTP discovery request arrives, e.g. GET /ssrf-proof/info/refs?service=git-upload-pack, driven entirely by the value from the dump file.

Record: GHSA-xmj7-xj85-hfc3
CVSS 3.1: 6.3 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Weakness: CWE-918
Updated: 2026-11-02

Show 4 moreShow less

OSVGO-2026-6084 No score

Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL in gitea.dev

Gitea: SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL in gitea.dev

Record: GO-2026-6084
Updated: 2026-11-02

OSVopenSUSE-SU-2026:21551-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: openSUSE-SU-2026:21551-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23216-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: SUSE-SU-2026:23216-1
Updated: 2026-11-02

OSVSUSE-SU-2026:23227-1 No score

Security update for govulncheck-vulndb

This update for govulncheck-vulndb fixes the following issues:

Update to version 0.0.20260727T201416 2026-07-27T20:14:16Z (jsc#PED-11136):

Go CVE Numbering Authority IDs added or updated with aliases:

GO-2026-5046 CVE-2026-46385 GHSA-w8j3-pq8g-8m7w
GO-2026-5047 CVE-2026-46384 GHSA-mc57-h6j3-3hmv
GO-2026-5048 GHSA-mx64-mj3q-7prj
GO-2026-5051
GO-2026-5069 CVE-2026-30246 GHSA-35hp-hqmv-8qg8
GO-2026-5074 CVE-2026-45022 GHSA-389r-gv7p-r3rp
GO-2026-5105 CVE-2026-41506 GHSA-3xc5-wrhm-f963
GO-2026-5116 CVE-2026-44517 GHSA-49p4-px3h-rq49
GO-2026-5158 CVE-2026-41178 GHSA-5wrp-cwcj-q835
GO-2026-5198 CVE-2026-41642 GHSA-7235-89m6-f4px
GO-2026-5208 CVE-2026-40890 GHSA-77fj-vx54-gvh7
GO-2026-5266 CVE-2026-41643 GHSA-8rxh-r2p6-7f2q
GO-2026-5309 GHSA-c3wq-j5vh-68rc
GO-2026-5327 CVE-2026-2303 GHSA-cp6g-7hqx-qxhp
GO-2026-5336 CVE-2026-45571 GHSA-crhj-59gh-8x96
GO-2026-5346 CVE-2026-52845 GHSA-f59h-q822-g45g
GO-2026-5408 GHSA-gx7w-56w6-g48x
GO-2026-5426 CVE-2026-39883 GHSA-hfvc-g4fc-pqhx
GO-2026-5435 CVE-2026-35206 GHSA-hr2v-4r36-88hr
GO-2026-5452 CVE-2026-34783 GHSA-j6v5-g24h-vg4j
GO-2026-5463 CVE-2026-8276 GHSA-jcqv-2g3v-gm88
GO-2026-5471 CVE-2026-6993 GHSA-jj45-xvq5-rhh9
GO-2026-5490 CVE-2026-44740 GHSA-m3xc-h892-ggx6
GO-2026-5492 CVE-2026-45135 GHSA-m675-2p33-xv9g
GO-2026-5506 CVE-2026-29181 GHSA-mh2q-q3fh-2475
GO-2026-5525 CVE-2026-42285 GHSA-p3w2-64xm-833j
GO-2026-5543 CVE-2026-32952 GHSA-pjcq-xvwq-hhpj
GO-2026-5548 CVE-2026-44166 GHSA-pq7p-mc74-g65w
GO-2026-5566 CVE-2026-35205 GHSA-q5jf-9vfq-h4h7
GO-2026-5569 GHSA-q76j-gcg9-vxc6
GO-2026-5585 CVE-2026-42554 GHSA-qjv7-627w-8qjv
GO-2026-5593 CVE-2026-40611 GHSA-qqx8-2xmm-jrv8
GO-2026-5595 CVE-2026-52844 GHSA-qrp7-cvwr-j2c6
GO-2026-5597 CVE-2026-44973 GHSA-qw64-3x98-g7q2
GO-2026-5606 GHSA-r46f-3rpw-hxrv
GO-2026-5617 CVE-2026-42306 GHSA-rg2x-37c3-w2rh
GO-2026-5660 CVE-2026-52846 GHSA-vcc4-2c75-vc9v
GO-2026-5666 CVE-2026-35204 GHSA-vmx8-mqv2-9gmg
GO-2026-5684 CVE-2026-42328 GHSA-w239-58x2-q8p5
GO-2026-5693 GHSA-w5pp-99ch-qj29
GO-2026-5730 GHSA-wwhq-w58m-w29c
GO-2026-5736 CVE-2026-44283 GHSA-x35m-3gp4-4fh5
GO-2026-5740 CVE-2026-44301 GHSA-x597-9fr4-5857
GO-2026-5748 CVE-2026-7482 GHSA-x8qc-fggm-mpqg
GO-2026-5750 CVE-2026-7020 GHSA-x99g-8v8j-25j2
GO-2026-5774 GHSA-3fxj-6jh8-hvhx
GO-2026-5775 GHSA-9g5q-2w5x-hmxf
GO-2026-5777 GHSA-rjr7-jggh-pgcp
GO-2026-5781
GO-2026-5841 GHSA-259r-337f-4rfw
GO-2026-5879 CVE-2026-50162 GHSA-8xwf-rjm4-xvhv
GO-2026-5880 CVE-2026-50163 GHSA-fxhp-mv3v-67qp
GO-2026-5882 CVE-2026-50151 GHSA-jxpm-75mh-9fp7
GO-2026-5884 GHSA-vh4v-2xq2-g5cg
GO-2026-5885 CVE-2026-48978 GHSA-xf85-363p-868w
GO-2026-5886 CVE-2026-44332 GHSA-g5vh-55hw-rxm8
GO-2026-5887 CVE-2026-45045 GHSA-gcfq-8gqf-4876
GO-2026-5912 CVE-2026-53624 GHSA-gv83-gqw6-9j2c
GO-2026-5954 CVE-2026-49838 GHSA-frrj-87jh-2772
GO-2026-5955 CVE-2026-49837 GHSA-gjrg-jjr3-56cm
GO-2026-5960 CVE-2026-54063 GHSA-h69g-9hx6-f3v4
GO-2026-5971 CVE-2026-37462 GHSA-pw7p-7fqv-hpj8
GO-2026-5983 CVE-2026-54448 GHSA-q3fv-x8vg-qqm4
GO-2026-6000 CVE-2026-50274 GHSA-74j5-xf3v-crq8
GO-2026-6058 CVE-2026-58442 GHSA-h2x6-g7q6-344v
GO-2026-6059 CVE-2026-58431 GHSA-h56g-4qw7-2mxg
GO-2026-6060 CVE-2026-58426 GHSA-hg5r-vq93-9fv6
GO-2026-6061 GHSA-hrxh-6v49-42gf
GO-2026-6062 CVE-2026-58434 GHSA-j2w3-9c3r-g83q
GO-2026-6063 CVE-2026-58417 GHSA-jr5x-6h83-wrxf
GO-2026-6064 CVE-2026-55984 GHSA-m932-crvm-gcp5
GO-2026-6065 CVE-2026-55982 GHSA-mg4f-x9v4-6h2p
GO-2026-6066 CVE-2026-58507 GHSA-p4mj-98mv-xq26
GO-2026-6067 CVE-2026-58445 GHSA-pgqf-926r-548m
GO-2026-6068 CVE-2026-58427 GHSA-prr9-9mp4-5gp2
GO-2026-6069 CVE-2026-58510 GHSA-q423-49rw-g9mh
GO-2026-6070 CVE-2026-58432 GHSA-q9pg-jj6x-j9p6
GO-2026-6071 CVE-2026-59766 GHSA-qf2f-qh6p-7v89
GO-2026-6072 CVE-2026-56750 GHSA-rgv6-xp99-6mgj
GO-2026-6073 CVE-2026-58435…

Record: SUSE-SU-2026:23227-1
Updated: 2026-11-02

Affected products

gitea open source git server

Affected packages

Affected packages
Package	Affected	Fixed
`code.gitea.io/gitea` Go	before 1.27.0	1.27.0
`gitea.dev` Go	before 1.27.0	1.27.0
`govulncheck-vulndb` SUSE:Linux Enterprise Server 16.0	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1
`govulncheck-vulndb` SUSE:Linux Enterprise Server for SAP applications 16.0	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1
`govulncheck-vulndb` openSUSE:Leap 16.0	before 0.0.20260727T201416-160000.1.1	0.0.20260727T201416-160000.1.1

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-58441 is a medium vulnerability (CVSS 6.3) in Gitea Open Source Git Server, published July 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 5th percentile. Fixed in code.gitea.io/gitea 1.27.0.

References

Show 80 moreShow less

This page doesn't list everything

Left out here: the rest of 5 source descriptions. The JSON record has them.