CVE-2026-58441

MediumCVSS 6.3

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.12%

2th percentile - higher than 2% of all known CVEs

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL.

An attacker can exploit this vulnerability to send requests to internal resources, potentially leading to unauthorized access or data leakage.

Update Gitea to a patched version and ensure URL fields are properly sanitized before use.

Original NVD description (English source)

SSRF in restore-repo via unsanitized pull_request.yml Head.CloneURL