{"id":"EUVD-2026-58126","enisaUuid":"b47a6775-a671-3d24-b9b4-f57d066f6a17","description":"SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata","datePublished":"Aug 13, 2026, 4:44:59 PM","dateUpdated":"Aug 14, 2026, 7:01:54 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc\nhttps://github.com/go-gitea/gitea/releases/tag/v1.27.0\nhttps://blog.gitea.com/gitea-1.27.0-is-released/\n","aliases":"CVE-2026-59765\nGHSA-2wm4-vwp6-v7xc\n","assigner":"Gitea","epss":0.37,"enisaIdProduct":[{"id":"26dad26b-6be5-3304-ae9b-750728857881","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.4"}],"enisaIdVendor":[{"id":"df9fd510-25f5-320a-830c-e60118677d1d","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"4e737dea-0efb-3502-b6a1-236d8ce699d1","vulnerability":{"id":"CVE-2026-59765","description":"SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata","datePublished":"Aug 13, 2026, 4:44:59 PM","dateUpdated":"Aug 14, 2026, 7:01:54 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc\nhttps://github.com/go-gitea/gitea/releases/tag/v1.27.0\nhttps://blog.gitea.com/gitea-1.27.0-is-released/\n","enisa_id":"EUVD-2026-58126\n","assigner":"Gitea","epss":0.37,"dataProcessed":"Nov 7, 2026, 7:21:28 AM","vulnerabilityProduct":[{"id":"d58d97a7-6a9b-3f39-bd42-a6e84a8d3ae4","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.4"}],"vulnerabilityVendor":[{"id":"5a49ecd0-36ea-39b5-8b7d-fd4e54fa25e6","vendor":{"name":"Gitea"}}]}},{"id":"70947b64-b689-33c5-b0e4-d2870a869186","vulnerability":{"id":"GHSA-2wm4-vwp6-v7xc","description":"Gitea: SSRF via Migration Asset Downloads Bypasses hostmatcher — Reads Internal Files and Cloud Metadata","datePublished":"Jul 21, 2026, 9:55:31 PM","dateUpdated":"Sep 24, 2026, 3:29:33 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-59765\nhttps://github.com/go-gitea/gitea/commit/de4b8277e9cb576f2315fb03b5ab6478b42a1d31\nhttps://blog.gitea.com/gitea-1.27.0-is-released\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.27.0\n","enisa_id":"EUVD-2026-58126\n","aliases":"GHSA-2wm4-vwp6-v7xc\nCVE-2026-59765\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}