repo/setting.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 does not validate the form.MirrorAddress before calling SaveAddress.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-11228.json"