요약
- CVE-2026-25779은(는) code.gitea.io/gitea, github.com/go-gitea/gitea에 영향을 주는 보통 (CVSS 6.1) 취약점입니다.
- 향후 30일 내 악용 확률(EPSS): 0.30%, 전체 취약점의 23.2%보다 높음.
- 조치: 1.26.0 이상으로 업데이트하세요.
Description
Details
Despite the validation within urlIsRelative in modules/httplib/url.go, an open redirect is still possible due to usage of directory traversal sequences plus a back-slash in the "redirect_to" parameter.
PoC
When a user uses this URL to login:
https://gitea.com/user/login?redirect_to=/a/../\example.com
They would be redirected to example.com upon a successful login to their gitea account.
Impact
- Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages
- OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect
- Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header
- Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users
NVD description
Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free