kritisch
CVE-2026-95106
Gitea review and execution mismatch through duplicate tree entries
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut Bitnami.
Beschreibung
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | gitea | 28.0.0 |
| minimos | gitea, gitea-fips | 28.0.0-r0 |
| rapidfort alpine 3.20 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.21 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.22 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.23 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.24 | gitea | 28.2.0-r0 |
Alle 8 Einträge aus 7 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | gitea | 28.0.0 |
| minimos | gitea | 28.0.0-r0 |
| minimos | gitea-fips | 28.0.0-r0 |
| rapidfort alpine 3.20 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.21 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.22 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.23 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.24 | gitea | 28.2.0-r0 |