GHSA-j5r2-4c8j-xc3m

Source

https://github.com/advisories/GHSA-j5r2-4c8j-xc3m

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j5r2-4c8j-xc3m/GHSA-j5r2-4c8j-xc3m.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-j5r2-4c8j-xc3m

Aliases

Published

2026-06-17T18:10:46Z

Modified

2026-06-25T23:11:06Z

Severity

5.1 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Gitea: Open Redirect via redirect_to

Details

Details

Despite the validation within urlIsRelative in modules/httplib/url.go, an open redirect is still possible due to usage of directory traversal sequences plus a back-slash in the "redirect_to" parameter.

PoC

When a user uses this URL to login:

https://gitea.com/user/login?redirect_to=/a/../\example.com

They would be redirected to example.com upon a successful login to their gitea account.

Impact

Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages
OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect
Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header
Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users

Database specific

{
    "cwe_ids": [
        "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-17T18:10:46Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
}

References

Affected packages

Go / github.com/go-gitea/gitea

Package

Name: github.com/go-gitea/gitea; View open source insights on deps.dev
Purl: pkg:golang/github.com/go-gitea/gitea

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.26.0

Database specific

last_known_affected_version_range

"<= 1.25.4"

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-j5r2-4c8j-xc3m/GHSA-j5r2-4c8j-xc3m.json"