The vulnerability in Gitea before version 1.27.0 involves improper validation of the DownloadURL field in release attachments used during the restore-repo command. This field supports the file:// URI scheme without restrictions, allowing an attacker with operator-level privileges who can supply a crafted archive to cause the server to read arbitrary local files. The contents of these files can then be stored as release attachments accessible via the API, constituting a local file inclusion (LFI) vulnerability. The CVSS 4.0 vector indicates a local attack vector requiring high privileges, with moderate impact on confidentiality and no impact on integrity or availability.

An attacker with operator-level access can read arbitrary files on the server that the Gitea process user can access. These files' contents can be exposed via the API as release attachments, potentially leaking sensitive information. There is no indication of remote exploitation without operator privileges or impact on system integrity or availability.

A patch is available for this vulnerability. Users should upgrade Gitea to version 1.27.0 or later to remediate this issue. Since this is not a cloud service, remediation depends on applying the official fix. No additional mitigations are indicated.