Gitea's restore-repo CLI command improperly validates the pull_request.yml Head.CloneURL field, disabling the intended safety check by passing an empty base URL. This flaw allows an attacker to supply arbitrary URLs in git fetch commands, enabling Server-Side Request Forgery (SSRF) attacks targeting internal services or local git repositories accessible via file:// URLs. The vulnerability affects all versions prior to 1.27.0. No remote code execution through git transport helpers has been observed, and no public exploits are currently known. The vulnerability is tracked as CVE-2026-58441 and has a CVSS 3.1 score of 6.3 (medium severity).

Successful exploitation can lead to SSRF attacks, potentially allowing attackers to access internal network services or local git repositories via crafted URLs. There is no indication of remote code execution or system compromise beyond information disclosure through SSRF. The vulnerability requires local access (low attack vector) and user interaction, but it can result in high confidentiality impact due to unauthorized data exposure.

A patch is available in Gitea version 1.27.0 and later. Users should upgrade to version 1.27.0 or newer to remediate this vulnerability. No additional mitigations are specified by the vendor advisory. Since this is not a cloud service, remediation depends on applying the official fix.