~ / search / GHSA-rc56-rj3f-xggf

GHSA-rc56-rj3f-xggf

Gitea LFS mirror operations bypass migration HTTP transport protections

Source: GitHub Advisory Database (reviewed) Critical CVE-2026-26292

Packages

EcosystemPackageAffectedFixed in
Go code.gitea.io/gitea < 1.25.5 1.25.5

Details

As written in the advisory (Markdown source, shown as plain text).

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

References

External links from the advisory. They lead to third-party sites.