critique
CVE-2026-95106
Gitea review and execution mismatch through duplicate tree entries
Dans la Trivy database depuis au moins le 24 oct. 2026, 07:11 UTCLa date d'entrée avant ce build n'est pas enregistrée.
Sévérité par source
Bitnami9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Le label propre à Trivy est CRITICAL. Critique selon Bitnami.
Description
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.
Paquets affectés et versions corrigées
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | gitea | 28.0.0 |
| minimos | gitea, gitea-fips | 28.0.0-r0 |
| rapidfort alpine 3.20 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.21 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.22 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.23 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.24 | gitea | 28.2.0-r0 |
Afficher les 8 entrées de 7 sources
| Source | Paquet | Corrigé en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | gitea | 28.0.0 |
| minimos | gitea | 28.0.0-r0 |
| minimos | gitea-fips | 28.0.0-r0 |
| rapidfort alpine 3.20 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.21 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.22 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.23 | gitea | 28.2.0-r0 |
| rapidfort alpine 3.24 | gitea | 28.2.0-r0 |