critical9.8
CVE-2026-26292
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport prot…
Impact
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | code.gitea.io/gitea | < 1.25.5 | 1.25.5 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/advisories/GHSA-rc56-rj3f-xggf
- https://nvd.nist.gov/vuln/detail/CVE-2026-26292
- https://github.com/go-gitea/gitea/pull/36665
- https://github.com/go-gitea/gitea/pull/36691
- https://blog.gitea.com/release-of-1.25.5
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5
- https://github.com/go-gitea/gitea/commit/996cc12bf7d54ae2326f20b4211fff70eb31e74a
- https://github.com/go-gitea/gitea/commit/bcd253a310115045d3ec5e8168a953fbee34dd28
- https://blog.gitea.com/release-of-1.25.5/