CVE-2026-95106— Gitea review and execution mismatch through duplicate tree entries
Quick assessment
Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Gitea 接受了推送的 Git 树中包含两个同名条目（Git 自身的完整性检查会拒绝此类情况）。在 Gitea 的 Web 界面中，此类路径会被解析为第一个条目；而在执行 、运行 Gitea Actions 以及生成发布压缩包时，则会使用最后一个条目。因此，攻击者可以发起一个拉取请求（Pull Request），其差异视图和文件视图显示无害内容，但在同一提交下的 CI 流程和代码检出则会使用由攻击者控制的、不同的内容。 现在，对传入的对象进行了完整性一致性检查；但已存储在现有仓库中的对象不会被重新扫描。
Possible ATT&CK Techniques 1 AI
T1505.003 · Web Shell
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-95106
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea review and execution mismatch through duplicate tree entries
Source: CVE Program / CVE List V5
Vulnerability Description
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-95106
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-95106
请登录查看更多情报信息。
Other References for CVE-2026-95106 (4)
-
https://github.com/go-gitea/gitea/releases/tag/v28.0.0 release-notes
-
https://blog.gitea.com/release-of-28.0.0/ release-notes
Same Patch Batch · Gitea · 2026-10-06 · 21 CVEs total
| CVE-2026-104632 | Gitea fork workflow approval bypass through cancel and rerun | |
| CVE-2026-73278 | Gitea WebAuthn bypass during OAuth and OIDC sign-in | |
| CVE-2026-79960 | Gitea deploy key pushes acting as the repository owner | |
| CVE-2026-70357 | Gitea repository migration SSRF through DNS rebinding | |
| CVE-2026-96580 | Gitea Actions memory exhaustion through large static matrices | |
| CVE-2026-96589 | Gitea private repository access retained after rejected transfer | |
| CVE-2026-96400 | Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS | |
| CVE-2026-96399 | Gitea denial of service through external issue tracker patterns | |
| CVE-2026-96404 | Gitea installer authentication bypass for existing accounts | |
| CVE-2026-104626 | Gitea fork workflow job revival through later approval | |
| CVE-2026-94205 | Gitea fork workflow approval bypass through maintainer-triggered events | |
| CVE-2026-104636 | Gitea SSRF through Git HTTP redirects in mirrors and fetches | |
| CVE-2026-101027 | Gitea migration SSRF through ALLOWED_DOMAINS address check bypass | |
| CVE-2026-101029 | Gitea migration and pull mirror SSRF through multi-answer DNS | |
| CVE-2026-95112 | Gitea issue reference parsing CPU exhaustion | |
| CVE-2026-89430 | Gitea push mirror SSRF and forced writes to internal Git hosts | |
| CVE-2026-103504 | Gitea API team demotion not applied to unit permissions | |
| CVE-2026-103667 | Gitea container registry stored XSS through blob media type | |
| CVE-2026-103059 | Gitea built-in SSH server authentication bypass through key case folding | |
| CVE-2026-103670 | Gitea trusted workflow cancellation by unapproved fork runs |
IV. Related Vulnerabilities
Same product: Gitea
-
CVE-2026-73278
Gitea WebAuthn bypass during OAuth and OIDC sign-in -
CVE-2026-96589
Gitea private repository access retained after rejected tran -
CVE-2026-96580
Gitea Actions memory exhaustion through large static matrice -
CVE-2026-96404
Gitea installer authentication bypass for existing accounts -
CVE-2026-96400
Gitea migration SSRF to reserved addresses through ALLOWED_D
Same vendor: Gitea
-
CVE-2026-73278
Gitea WebAuthn bypass during OAuth and OIDC sign-in -
CVE-2026-96589
Gitea private repository access retained after rejected tran -
CVE-2026-96580
Gitea Actions memory exhaustion through large static matrice -
CVE-2026-96404
Gitea installer authentication bypass for existing accounts -
CVE-2026-96400
Gitea migration SSRF to reserved addresses through ALLOWED_D
V. Comments for CVE-2026-95106
No comments yet