Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Dismissed

(no matching packages found)

Permalink CVE-2026-25779

created 2 weeks, 1 day ago Activity log

Created & dismissed (no matching packages found) suggestion 2 weeks, 1 day ago

Gitea redirect handling permits open redirects through backslash paths

Gitea versions up to and including 1.25.4 allow redirect bypasses through raw or percent-encoded backslashes in redirect_to values.

References

GitHub Security Advisory vendor-advisory
GitHub Pull Request #36660 patch
GitHub Pull Request #36716 patch
Gitea v1.25.5 Release release-notes
Gitea v1.25.5 Release Blog Post release-notes

Affected products

Gitea Open Source Git Server

=<1.25.4