CVE-2026-95106

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-95106

EUVD

EUVD-2026-93913

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-706	The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.

Attack-Flow Graph

Executive Summary

Gitea allowed Git trees with duplicate entry names, which Git itself rejects. Web views showed the first entry while checkouts and CI used the last. This could let a contributor hide malicious content in CI while showing harmless content in pull requests.

Detection Guidance

This vulnerability involves inconsistent handling of Git trees with duplicate entries. To detect it, inspect repositories for duplicate file paths in Git objects using commands like 'git fsck' to check for corruption and 'git log --all --full-history -- .' to review file history. Compare web views with actual checkouts to identify discrepancies.

Impact Analysis

An attacker could trick you into running malicious code during CI or checkout while the web interface shows safe content. This could lead to code execution, data theft, or unauthorized changes in your repository.

Compliance Impact

This vulnerability could potentially impact compliance with standards like GDPR or HIPAA by enabling unauthorized code execution in CI/CD pipelines or release artifacts. Attackers could inject malicious content that bypasses review while altering deployed software, risking data integrity or confidentiality violations.

Mitigation Strategies

Update Gitea to the latest version to ensure incoming objects are checked for consistency. Existing repositories do not need rescanning as the fix only applies to new objects.

Hi! I’m here to help you understand CVE-2026-95106. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70