IT-Sentinel

« BACK_TO_HOME

PUBLISHED

2026-08-13 17:17

MODIFIED

2026-08-13 17:17

EPSS (Prob. Exploit)

0.43%

Top 63.1%

DATA SOURCES:

NVD 🔗 2026-08-13 CWE MITRE 🔗 2026-11-01 FIRST EPSS 🔗 2026-11-01 GITHUB 🔗 2026-10-29 OSV 🔗 2026-10-26

> DESCRIPTION

Repository migration SSRF via multi-answer DNS allow-list bypass

> AFFECTED_PRODUCTS

ℹ️ Aucun produit affecté n'a encore été publié par NVD pour cette CVE.

> WEAKNESSES

CWE-200 CWE-918

> CWE DETAILED DESCRIPTIONS

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor - The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. | CWE-918: Server-Side Request Forgery - The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

> GITHUB SECURITY ADVISORY

GHSA-h2x6-g7q6-344v MODERATE

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass

AFFECTED PACKAGES:

GO / code.gitea.io/gitea

< 1.27.0

Fixed in: 1.27.0

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

Repository migration SSRF via multi-answer DNS allow-list bypass

AFFECTED PACKAGES:

Unknown / Unknown

38 versions affected

ALIASES:

GHSA-h2x6-g7q6-344v, GO-2026-6058

> HISTORIQUE DES MODIFICATIONS

Première apparition

13/08/2026 17:17

Source: NVD

📊 ENRICHISSEMENT 01/11/2026 06:59

CWE

Champ modifié: Description CWE

Ancienne valeur:

Nouvelle valeur:

📊 ENRICHISSEMENT 01/09/2026 06:02

CWE

Champ modifié: Description CWE

Ancienne valeur:

N/A

Nouvelle valeur:

Total des modifications: 2 Dernière mise à jour: 3 hours ago

> REFERENCES

https://blog.gitea.com/gitea-1.27.0-is-released/

https://github.com/go-gitea/gitea/releases/tag/v1.27.0

https://github.com/go-gitea/gitea/security/advisories/GHSA-h2x6-g7q6-344v