{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-110311 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-110311 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-110311 is a medium-severity vulnerability in Gitea, published on 18 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-110311 and fix it if it is affected.\n\nWhat it is: CVE-2026-110311 is a medium-severity vulnerability in Gitea, published on 18 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-110311 in the wild and no public exploit code.\n\nAffected product: Gitea. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-110311/ (Markdown: https://insights.sbomify.com/CVE-2026-110311/index.md)","id":"CVE-2026-110311","markdown":"https://insights.sbomify.com/CVE-2026-110311/index.md","name":"CVE-2026-110311","record":{"aliases":["GHSA-8j56-f865-gqq2"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"Gitea Git hosting","requires_auth":"low_privilege","summary":"Attackers with draft release permissions can view metadata of attachments from repositories they cannot access, exposing sensitive file details.","user_interaction":"not_required","vuln_class":"information_disclosure"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Gitea","cpe":[],"cvss":{"score":4.3,"severity":"medium","source":"cisa-adp","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","version":"3.1"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"description":"Creating a draft release through the API returned an `assets` list that was built from a release without an ID, which matched every attachment that was not linked to a release. A user who could create a draft release in a repository therefore received the metadata (file name, UUID, upload time, size and download count) of issue and comment attachments of repositories they could not read, and of abandoned uploads.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-10-29","github_poc":1,"max_poc_stars":0,"metasploit":0,"nuclei":0,"refs":[{"date":"2026-10-29T12:00:10Z","kind":"github_poc","ref":"https://github.com/akiraraikou36-hub/cve-2026-110311-gitea-lab","stars":0,"title":"Local Gitea CVE-2026-110311 reproduction: vulnerable vs patched comparison, Python verifier, recorded evidence, and Turkish report."}],"tier":"poc_unverified"},"has_fix":false,"headline":"Gitea draft release creation disclosing attachment metadata","id":"CVE-2026-110311","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"information_disclosure","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"WebSocket frames keep reaching the WebSock after a server-initiated close in Bandit","id":"CVE-2026-110314"},"packages":[],"prev":{"headline":"RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET","id":"CVE-2026-110310"},"products":["Gitea"],"published":"2026-10-18","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Gitea"]},"summary":"Attackers with draft release permissions can view metadata of attachments from repositories they cannot access, exposing sensitive file details.","url":"https://insights.sbomify.com/CVE-2026-110311/"}