GHSA-J5R2-4C8J-XC3M中危已审查

Gitea: Open Redirect via redirect_to

OSV 1.4.0 · github-reviewed · 修改于 2026-06-18 02:10

发布时间

2026-06-18 02:10

GitHub 审查时间

2026-06-18 02:10

NVD 发布时间

—

源文件

advisories/github-reviewed/2026/06/GHSA-j5r2-4c8j-xc3m/GHSA-j5r2-4c8j-xc3m.json

公告说明

Details

Despite the validation within urlIsRelative in modules/httplib/url.go, an open redirect is still possible due to usage of directory traversal sequences plus a back-slash in the "redirect_to" parameter.

PoC

When a user uses this URL to login:

https://gitea.com/user/login?redirect_to=/a/../\example.com

They would be redirected to example.com upon a successful login to their gitea account.

Impact

Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages
OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect
Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header
Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users

受影响的软件包

github.com/go-gitea/gitea

标识信息

别名 / CVE

CVE-2026-25779

CWE

CWE-601

软件生态

扩展资料

暂无扩展资料。

CVSS 评分

CVSS_V4

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

原始 OSV JSON

{
  "id": "GHSA-j5r2-4c8j-xc3m",
  "aliases": [
    "CVE-2026-25779"
  ],
  "details": "### Details\n\nDespite the validation within `urlIsRelative` in `modules/httplib/url.go`, an open redirect is still possible due to usage of directory traversal sequences plus a back-slash in the \"redirect_to\" parameter.\n\n### PoC\n\nWhen a user uses this URL to login:\n\n`https://gitea.com/user/login?redirect_to=/a/../\\example.com`\n\nThey would be redirected to `example.com` upon a successful login to their gitea account.\n\n### Impact\n\n* Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages\n* OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect\n* Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header\n* Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users",
  "summary": "Gitea: Open Redirect via redirect_to",
  "affected": [
    {
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.0"
            }
          ]
        }
      ],
      "package": {
        "name": "github.com/go-gitea/gitea",
        "ecosystem": "Go"
      },
      "database_specific": {
        "last_known_affected_version_range": "<= 1.25.4"
      }
    }
  ],
  "modified": "2026-06-17T18:10:46Z",
  "severity": [
    {
      "type": "CVSS_V4",
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N"
    }
  ],
  "published": "2026-06-17T18:10:46Z",
  "references": [
    {
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-j5r2-4c8j-xc3m",
      "type": "WEB"
    },
    {
      "url": "https://github.com/go-gitea/gitea",
      "type": "PACKAGE"
    }
  ],
  "schema_version": "1.4.0",
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "nvd_published_at": null,
    "github_reviewed_at": "2026-06-17T18:10:46Z"
  }
}