CVE-2026-95106

9.1 CRITICALpublic exploit available

Published 2026-10-06 · Updated 2026-10-07

AI risk analysis

Summary: This flaw allows a contributor to push Git trees with duplicate names, leading to inconsistent content when checked out or used in CI processes, potentially exposing sensitive data.
Exploitability: Exploitation requires a contributor with push access to the repository. The difficulty lies in ensuring the pushed content is used in CI processes.
Blast radius: If exploited, the impact is limited to repositories where the affected feature is used, potentially leading to data leakage in CI environments.
Detection: No reliable host or network indicator is derivable from the published description.
Prioritized remediation: Upgrade to Gitea version 1.15.2 or later.

webgitci

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weaknesses

CWE-706

Public exploit & PoC references

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.