by Kastro
Paper/Archive/CVE-2026-26292

CVE-2026-26292

Gitea Gitea Open Source Git Server — Gitea LFS mirror synchronization bypasses migration HTTP transport restrictions

EPSS 0.7%CVSS 9.8
critical.is priorityof 100
40
CVSS 9.8 (ADP)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 51.2.512 × 2010.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

Affected

ProductAffectedFixed inSource
Gitea Open Source Git Server< 1.25.51.25.5CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchgithub.com/go-gitea/gitea/pull/36665patchgithub.com/go-gitea/gitea/pull/36691refgithub.com/go-gitea/gitea/releases/tag/v1.25.5refblog.gitea.com/release-of-1.25.5