Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.1

Gitea can display different code than what is built

CVE-2026-95106 · published 3 days ago
Summary

Gitea can accept a repository that contains two files with the same name. When this happens, the web interface shows the first version while the build system and downloads use the second version, so a malicious change could go unnoticed in reviews. Update Gitea to the latest release, which now checks for this inconsistency, and re‑scan existing repositories if possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gitea gitea <= 1.27.3
Original advisory text
Gitea review and execution mismatch through duplicate tree entries
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.1 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-706Use of Incorrectly-Resolved Name or Reference
Timeline
Published6 Oct 2026
Updated9 Oct 2026
First seen6 Oct 2026
Sources
CVE-2026-95106 · NVD
CVE-2026-95106 · MITRE
CVE-2026-95106 · OSV
GHSA-6pv5-8rp7-8c75 · GHSA
Track software like this
Free during beta