What’s Vulnerable › Vulnerabilities

CVE-2026-86684: Gitea push mirror local path check uses the repository owner

• Severity: high (CVSS 7.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-10-06 · updated 2026-10-13
• Weakness: CWE-863

Description

The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.

Affected products

• Gitea Open Source Git Server: from 1.18.0 before 28.1.0 — fixed in 28.1.0

How to fix

Upgrade to a fixed version: Gitea Open Source Git Server 28.1.0. Check the vendor advisory for mitigations.

References

• https://blog.gitea.com/release-of-28.1.0/
• https://github.com/go-gitea/gitea/pull/39501
• https://github.com/go-gitea/gitea/pull/39507
• https://github.com/go-gitea/gitea/releases/tag/v28.1.0
• https://github.com/go-gitea/gitea/security/advisories/GHSA-7v5j-mph8-9w6g

Get alerted when CVE-2026-86684 or the next vulnerability affects your stack