CVE-2026-58441 | Gitea up to 1.26.4 Restore pull_request.yml Head.CloneURL server-side request forgery

A vulnerability classified as critical has been found in Gitea up to 1.26.4. This impacts an unknown function of the file pull_request.yml of the component Restore. The manipulation of the argument Head.CloneURL leads to server-side request forgery.

This vulnerability is uniquely identified as CVE-2026-58441. The attack is possible to be carried out remotely. No exploit exists.VulDB Recent EntriesRead More