CVE-2026-95106: Gitea Privilege Escalation Vulnerability

CVE-2026-95106 Overview

CVE-2026-95106 affects Gitea, a self-hosted Git service. Gitea accepted pushed Git trees containing two entries with the same name, a condition Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry. In contrast, git checkout, Gitea Actions, and release archives used the last entry. A contributor could open a pull request whose diff and file views display benign content while continuous integration and checkouts at the same commit execute attacker-controlled content. The issue is addressed in Gitea v28.0.0, which validates incoming objects for consistency. Objects already stored in existing repositories are not rescanned.

Critical Impact

Attackers can bypass code review by submitting pull requests where reviewed content differs from the content executed by CI pipelines and checked out by downstream consumers.

Affected Products

• Gitea versions prior to v28.0.0
• Gitea Actions runners consuming affected repositories
• Release archive consumers relying on Gitea-generated archives

Discovery Timeline

• 2026-10-06 - CVE-2026-95106 published to the National Vulnerability Database (NVD)
• 2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-95106

Vulnerability Analysis

The vulnerability is a business logic flaw rooted in inconsistent tree entry resolution between Gitea's web interface and underlying Git tooling. Git's object model forbids a tree from containing two entries with identical names. Canonical Git implementations enforce this through git fsck and similar consistency checks. Gitea did not perform this validation on pushed objects.

When a tree contains duplicate entries, consumers must choose which one wins. Gitea's web UI, including diff and file browsing views, resolves such paths to the first matching entry. git checkout, Gitea Actions workflows, and release archive generation resolve the same path to the last matching entry. This divergence creates a split-view condition where reviewers and executors see different code at the same commit hash.

Root Cause

The root cause is missing object consistency validation on incoming pushes. Gitea did not reject trees containing duplicate name entries, violating Git's object format invariants. Combined with inconsistent tree-walking logic across subsystems, this allows two valid-looking file contents to coexist under one path within a single commit.

Attack Vector

An authenticated contributor crafts a malicious tree object containing two entries with the same filename. The first entry holds benign content shown to reviewers. The second entry holds attacker-controlled content executed by CI. The attacker pushes the object to a repository and opens a pull request. Reviewers approve based on the sanitized diff. Upon merge or CI trigger, Gitea Actions checks out the last entry and executes the hostile payload. Release archives generated for the same commit distribute the malicious variant to downstream consumers.

See the GitHub Security Advisory GHSA-6pv5-8rp7-8c75 for technical details.

Detection Methods for CVE-2026-95106

Indicators of Compromise

• Repository tree objects containing two or more entries with identical names, detectable via git fsck --strict run against the bare repository on the Gitea server.
• Gitea Actions workflow runs that produce artifacts or behavior inconsistent with the reviewed pull request diff for the same commit SHA.
• Release archive contents that differ from file views shown in the Gitea web UI for the same tag or commit.

Detection Strategies

• Run git fsck --strict across all hosted repositories to identify stored objects that violate Git consistency rules, since existing objects are not rescanned by the Gitea fix.
• Compare file hashes between Gitea web view downloads and git checkout output for sensitive paths such as CI configuration, build scripts, and release manifests.
• Audit pull requests merged before the upgrade to v28.0.0 for anomalous CI behavior, unexplained build output changes, or divergence between reviewer-visible diffs and execution logs.

Monitoring Recommendations

• Monitor Gitea Actions logs for commands or network connections that do not correspond to the reviewed source in a given commit.
• Alert on git fsck failures introduced into repository mirror or backup pipelines.
• Track administrative events on Gitea instances, including repository pushes from new or low-reputation contributors targeting repositories with active CI pipelines.

How to Mitigate CVE-2026-95106

Immediate Actions Required

• Upgrade Gitea to v28.0.0 or later to enable consistency checks on incoming Git objects.
• Run git fsck --strict on every repository hosted by the Gitea instance to detect pre-existing malicious tree objects, since the fix does not rescan stored data.
• Review the merge and CI history of repositories that accepted pushes before the upgrade, prioritizing those with privileged Actions workflows.

Patch Information

The fix is included in Gitea Release v28.0.0. The change is implemented in GitHub Pull Request #39472 and documented in the Gitea Blog Release Announcement. Incoming objects are now validated for consistency; objects already stored in existing repositories are not rescanned and must be audited manually.

Workarounds

• Add a pre-receive hook that invokes git fsck on incoming objects and rejects pushes containing trees with duplicate entry names.
• Restrict push and pull request privileges to trusted contributors on repositories with Actions workflows that handle secrets or produce published artifacts.
• Require manual verification of CI run artifacts against the reviewed diff before merging pull requests from external contributors on affected Gitea versions.

# Scan all repositories for inconsistent tree objects
find /var/lib/gitea/git/repositories -name '*.git' -type d -exec \
  git --git-dir={} fsck --strict --no-dangling \;