Gitea CVE-2026-34966

Exploitation via the migration path requires an authenticated Gitea account with sufficient privileges to invoke the repository migration API endpoint; the attacker must also control a Gitea-compatible source instance that serves malicious asset download URLs or PR patch URLs pointing to internal services or local paths. The file:// local read path is enabled by uri.Open()'s explicit os.Open() branch and requires no additional configuration - it is active in all default Gitea deployments prior to 1.27.0. The OAuth avatar path requires the target Gitea instance to have OAuth authentication configured and enabled. Exploitation is strictly limited to authenticated users; unauthenticated access is not sufficient for any of the three vectors. The provided CVSS 4.0 vector designates PR:H (high privileges), but defenders should verify whether their Gitea configuration restricts migration initiation to administrators only - in permissive default deployments, any registered user may trigger migrations, lowering the effective privilege barrier.

The CVSS 4.0 score of 8.3 with vector AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N reflects high confidentiality impact on both the vulnerable Gitea system and subsequent systems - consistent with the ability to read application secrets such as database credentials and JWT signing keys, enabling downstream compromise. The PR:H designation (high privileges required) in the provided vector is notable: the description states only 'authenticated attackers,' and Gitea migration is available to non-admin users in many default configurations - security teams should verify the minimum privilege level enforced in their deployment, as real-world exploitability may be broader than PR:H implies. EPSS data was not provided; however, the combination of a public PoC embedded in the GHSA advisory, network-accessible attack vector, and high-value exfiltration targets (cloud IMDS, app.ini credentials) elevates real-world urgency. The exfiltration persistence mechanism - attacker-retrievable content stored as migration release assets - reflects deliberate exploit design rather than opportunistic discovery. The vulnerability is not in CISA KEV, so confirmed active exploitation is absent, but the accessible PoC and attractive targets make this a credible near-term exploitation scenario for internet-exposed Gitea instances.

An authenticated Gitea user sets up an attacker-controlled Gitea instance and creates a repository release whose asset download URL points to file:///etc/gitea/app.ini or http://169.254.169.254/latest/meta-data/iam/security-credentials/role. When migration is triggered targeting that repository, the victim Gitea server fetches those URLs server-side via unprotected http.Get(), and the retrieved content is persisted as a migration release asset that the attacker can subsequently retrieve. A public proof-of-concept demonstrating this full chain is included in GHSA-2wm4-vwp6-v7xc.