CVE-2026-95106 Gitea CVE debrief

Who should care

Defenders managing Gitea deployments, especially those with untrusted contributors, should assess exposure and prioritize verification and remediation. This includes reviewing Gitea version information, monitoring for suspicious activity, and restricting contributor permissions to prevent unauthorized changes.

Why it matters

CVE-2026-95106 allows a contributor to bypass Gitea's content validation, potentially leading to malicious content execution in CI and checkouts. Defenders should verify Gitea deployments and prioritize remediation.

• Verify Gitea version and apply patches to prevent potential malicious content execution.
• Monitor for suspicious pull requests and CI pipeline activity.
• Restrict contributor permissions to prevent unauthorized changes.

Technical summary

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content.

Defensive priority

Defenders should prioritize verifying Gitea deployments, especially those with untrusted contributors, and upgrading to version 28.0.0 or applying patches.

Recommended defensive actions

• Verify Gitea deployments for version 1.27.3 or earlier and upgrade to version 28.0.0 or apply patches.
• Monitor pull requests and CI pipelines for potential malicious activity.
• Restrict contributor permissions to prevent unauthorized changes.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and Gitea advisory provide details on the vulnerability. However, the exact scope of affected versions and potential impact require further verification. Affected versions are likely prior to 28.0.0. Defenders should verify Gitea deployments, especially those with untrusted contributors, and review the vendor advisory for specific version information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.