All vulnerabilities
CVE-2026-95106GHSA-6pv5-8rp7-8c75

Gitea review and execution mismatch through duplicate tree entries

Gitea Gitea
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 20% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in28.0.0Fixed versionGitHub
Published6 Oct 2026Updated 7 Oct 2026CVE List

What fixes it

  • 28.0.0gitea.dev, goGitHubgo get gitea.dev@v28.0.0

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while git checkout, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.

Text from CVE List

Affected versions 2

  • Giteaaffected: all versions through 1.27.3CVE List
  • gitea.dev, go<= 1.27.3GitHub

References 4