CVE-2026-95106 Gitea review and execution mismatch through duplicate tree entries

What is CVE-2026-95106?

CVE-2026-95106 is a critical code injection vulnerability in Gitea Gitea, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Gitea accepted pushed Git trees containing two entries with the same name, which Git's own consistency checks reject. Gitea's web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.

Weakness: CWE-706

Which versions are affected by CVE-2026-95106?

1 open source package ship an affected version, including gitea. It affects 1 product.

Products include Gitea Gitea.

How do I fix CVE-2026-95106?

Upgrade gitea to 28.0.0 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2026-95106 being exploited?

There is no known exploitation of CVE-2026-95106 in the wild and no public exploit code.

Other vulnerabilities in Gitea Gitea

• CVE-2026-60004 Gitea Code Injection Exploited Critical 9.8
• CVE-2026-73278 Gitea WebAuthn bypass during OAuth and OIDC sign-in Critical 9.8
• CVE-2026-94205 Gitea fork workflow approval bypass through maintainer-triggered events Critical 9.8
• CVE-2022-42968 Gitea vulnerable to Argument Injection Critical 9.8
• CVE-2021-45330 Improper Privilege Management in Gitea Critical 9.8

All Gitea Gitea vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-gitea-2026-95106, GHSA-6pv5-8rp7-8c75, MINI-gxfx-5mx3-2h5q, MINI-jq5c-pcj8-gj4h.