CVE-2026-25779: Gitea Open Redirect Vulnerability via redirect_to Parameter
Summary
CVE-2026-25779: Gitea: Open Redirect via redirect_to. Affects github.com/go-gitea/gitea versions < 1.26.0. Fixed in 1.26.0. How to fix ↓
Also tracked for
- code.gitea.io/gitea · Go
The same CVE-2026-25779 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is an open-source self-hosted Git service that allows users to manage their Git repositories. It provides features such as issue tracking, pull requests, and a user-friendly interface. However, Gitea is susceptible to an open redirect vulnerability due to improper validation of the 'redirect_to' parameter, which can be exploited by attackers.
Vulnerability Detail
The vulnerability arises from the inadequate validation within the 'urlIsRelative' function in the httplib module of Gitea. Attackers can exploit this flaw by using directory traversal sequences combined with a backslash in the 'redirect_to' parameter, allowing them to redirect users to arbitrary external sites. This can lead to phishing attacks, OAuth/SSO token theft, referer leakage, and cache poisoning, posing significant risks to users' credentials and sensitive information.
How To Fix
Latest published version: v1.8.3 as of 23 Oct 2026
go get github.com/go-gitea/gitea@v1.8.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.26.0
This is the first release that contains the fix.
go get github.com/go-gitea/gitea@v1.26.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can implement strict input validation on the 'redirect_to' parameter to ensure it does not accept any directory traversal sequences or backslashes. This can be done by sanitizing the input before processing it.
Conclusion
The CVE-2026-25779 vulnerability in Gitea poses significant risks due to its potential for exploitation through open redirects. Users are strongly advised to update to the patched version to mitigate these risks and ensure the security of their applications.
See every vulnerability recorded for github.com/go-gitea/gitea →
FAQ
An open redirect vulnerability allows attackers to redirect users to malicious sites without their consent, often leading to phishing attacks.
If exploited, this vulnerability can lead to phishing attacks, token theft, and exposure of sensitive information through referer leakage.
Yes, the vulnerability has been patched in Gitea version 1.26.0. Users are encouraged to update to this version or later.
Implement strict input validation on the 'redirect_to' parameter as a temporary workaround until you can update.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/go-gitea/gitea.
