Recommended action

Update github.com/go-gitea/gitea to 1.26.0 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Gitea: Open Redirect via redirect_to affects github.com/go-gitea/gitea (go). Severity is medium. ### Details Despite the validation within `urlIsRelative` in `modules/httplib/url.go`, an open redirect is still possible due to usage of directory traversal sequences plus a back-slash in the "redirect_to" parameter. ### PoC When a user uses this URL to login: `https://gitea.com/user/login?redirect_to=/a/../\example.com` They would be redirected to `example.com` upon a successful login to their gitea account. ### Impact * Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages * OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect * Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header * Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users

AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software

Recommended action

Update github.com/go-gitea/gitea to 1.26.0 if you use the affected versions. Test the change in a non-production environment first.

hol-guard supply-chain scan

What this means

Gitea: Open Redirect via redirect_to affects github.com/go-gitea/gitea (go). Severity is medium. ### Details Despite the validation within `urlIsRelative` in `modules/httplib/url.go`, an open redirect is still possible due to usage of directory traversal sequences plus a back-slash in the "redirect_to" parameter. ### PoC When a user uses this URL to login: `https://gitea.com/user/login?redirect_to=/a/../\example.com` They would be redirected to `example.com` upon a successful login to their gitea account. ### Impact * Phishing: Attackers can use trusted domain links to redirect victims to credential-harvesting pages * OAuth/SSO Token Theft: In authentication flows, authorization codes or tokens may leak via redirect * Referer Leakage: Sensitive URL parameters may be exposed to attacker domains via the Referer header * Cache Poisoning: In deployments with shared caches, malicious redirects may be cached and served to other users

AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.

Affected software