Path Traversal Issue in Gitea Affecting Multiple Git Operations

CVE-2026-95106

What is CVE-2026-95106?

Gitea's handling of Git trees has a flaw that permits the inclusion of multiple entries with identical names, which contravenes Git's standard consistency protocols. While Gitea's web views display the first listed entry, Git operations—such as git checkout, Gitea Actions, and release archives—tend to prioritize the last entry, potentially exposing users to malicious content that is hidden in pull requests. Although Gitea now verifies incoming objects for coherence, previously stored objects in existing repositories remain unchecked, leaving a window of vulnerability. Users must ensure they are running the latest version to mitigate risks.

References