CVE-2026-86684
Gitea push mirror local path check uses the repository owner
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.
| CWE | CWE-863 |
| Vendor | gitea |
| Product | gitea |
| Published | Oct 6, 2026 |
Stay Ahead of the Next One
Get instant alerts for gitea gitea
Be the first to know when new unknown vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Gitea / Gitea
1.18.0 ≤ 28.0.0
References
github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-7v5j-mph8-9w6g github.com: https://github.com/go-gitea/gitea/pull/39501 github.com: https://github.com/go-gitea/gitea/pull/39507 blog.gitea.com: https://blog.gitea.com/release-of-28.1.0/ github.com: https://github.com/go-gitea/gitea/releases/tag/v28.1.0
Credits
https://github.com/opensec-intelligence 🔍 https://github.com/mayank-jangid-moon 🔍 https://github.com/Kushalkhemka 🔍 https://github.com/skigeek16 https://github.com/silverwind https://github.com/bircni