Gitea: Review and execution mismatch through duplicate Git tree entries
Summary
Gitea accepted pushed Git commits whose trees contain two entries with the same file name, which git fsck rejects. Gitea's web views show the first entry, while git checkout, Gitea Actions and release archives use the last. A contributor can therefore get a pull request approved that displays harmless code while CI runs different, attacker-controlled code from the same commit SHA, potentially exposing CI secrets.
Affected
- Gitea up to and including 1.27.3
- The advisory reproduced the issue on 1.27.2; the shared Forgejo codebase is likely affected as well
Fixed in
- Gitea 28.0.0 (the release previously numbered 1.28.0), which rejects fsck-invalid objects on push (PR #39472)
- Later releases (28.1.0, 28.2.0) include this fix
- Upgrading does not clean up malformed trees already stored in existing repositories
Workaround
Unknown. The vendor documents no workaround. The advisory suggests showing a visible warning on trees with duplicate entries as an interim measure.
Exploitation
- CISA SSVC: exploitation none, automatable yes, technical impact total
- Not listed in CISA KEV
- No public proof of concept or in-the-wild exploitation known; the advisory describes the mechanism in detail
Our recommendation
- Update Gitea to 28.0.0 or later
- Run git fsck on repositories with external contributions, focusing on commits pushed before the upgrade, because the fix does not rescan existing objects
- Until patched, limit CI runs on untrusted pull requests and do not expose CI secrets to them
- Review who can open pull requests and who can approve them; prioritise public or internet-facing instances with CI secrets
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Gitea security advisory GHSA-6pv5-8rp7-8c75 github.com
- Fix pull request #39472: reject fsck-invalid objects on push github.com
- Gitea 28.0.0 release github.com
- Gitea vendor blog: release of 28.0.0 blog.gitea.com
- OSV entry CVE-2026-95106 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:22.
Original description (NVD)
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.