CVE-2026-95106 in Gitea
Summary
by MITRE • 10/06/2026
Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified involves a critical inconsistency in how Gitea processes Git repository data compared to standard Git implementations. Specifically, Gitea previously accepted pushed Git trees that contained two entries with identical names within the same directory level. This state violates fundamental Git consistency rules, as established by core Git tools which actively reject such malformed tree objects during normal operations. The flaw stems from a lack of rigorous validation on incoming object data, allowing contributors to introduce ambiguous file structures into repositories hosted on the platform.
The operational impact of this inconsistency is severe due to divergent resolution behaviors across different components of the Gitea ecosystem and external Git tools. When accessing web views such as diff or file listings, Gitea resolves the conflicting path by displaying content associated with the first entry found in the tree structure. In contrast, standard commands like git checkout, automated CI pipelines running via Gitea Actions, and generated release archives resolve to the last entry. This discrepancy creates a dangerous divergence between what is visually presented to users reviewing code changes and what is actually executed or deployed by downstream systems.
This architectural flaw enables sophisticated supply chain attacks where an attacker can craft a pull request that appears benign in its visual representation but contains malicious logic when checked out or built. A contributor could submit code that looks safe during peer review, as the web interface displays one set of files, while the continuous integration environment and final deployment stages process a different, potentially compromised version of those same files. This undermines the integrity of the software development lifecycle by decoupling verification from execution, allowing malicious payloads to bypass human inspection and automated security checks that rely on visual confirmation or standard git operations.
To mitigate this risk, Gitea has implemented stricter consistency checks for incoming objects during push operations. These validations ensure that tree structures adhere to Git standards before being stored in the database. However, it is important to note that these new safeguards apply only to newly pushed data; existing repositories containing previously accepted malformed trees are not automatically rescanned or corrected by default. Administrators may need to manually audit affected repositories or force re-clones from trusted sources to ensure consistency across all historical commits and branches.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation, as the system failed to correctly validate structured input data against expected constraints. It also relates to CWE-841 Improper Enforcement of Behavioral Validity, where the application allowed an invalid state that led to inconsistent behavior. In terms of attack vectors, this scenario is consistent with MITRE ATT&CK technique T1608 Linked Resources, which involves manipulating linked resources or dependencies to influence system behavior, and potentially T1583 Acquire Infrastructure if used as part of a broader campaign to compromise build environments. The incident highlights the necessity for strict adherence to underlying protocol specifications in application logic to prevent state divergence between different processing contexts.