A critical SSRF vulnerability in Gitea allows unauthenticated attackers to read internal files and cloud metadata by bypassing host filtering mechanisms.

The application fails to adequately sanitize migration and webhook URLs (CWE-918). While some functions use a hardened dialer, others utilize the Go DefaultClient, which bypasses host matching protections and allows requests to the local file system via the file scheme.

The CVSS score of 7.5 reflects the high risk of unauthorized information disclosure. An attacker can leverage this flaw to access sensitive cloud metadata, environment variables, or internal configuration files, which could lead to full system compromise or lateral movement within the network.

Immediate Action: Update Gitea Open Source Git Server to version 1.27.0 or later immediately.

Proactive Monitoring: Inspect server logs for outbound requests to internal IP addresses or unusual file access patterns originating from the Gitea service account.

Compensating Controls: Restrict Gitea's ability to initiate outbound network connections to internal resources using network-level access control lists (ACLs) or egress filtering.

Public Exploit Available: Yes, a proof-of-concept exists as identified per CISA's SSVC assessment.

Given the availability of a proof-of-concept and the potential for severe data leakage, upgrading to version 1.27.0 is mandatory. Organizations should treat this as a high-priority update to prevent potential exfiltration of sensitive cloud credentials.