High severity · published Oct 6, 2026
CVE-2026-86684
Gitea push mirror local path check uses the repository owner
7.1
CVSS
0.1%
EPSS
No
On KEV
Description
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with `[security] IMPORT_LOCAL_PATHS = true`, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.1% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GI
Gitea · Gitea
1.18.0 through 28.0.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-86684
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-86684
vendor-advisory
https://github.com/go-gitea/gitea/security/advisories/GHSA-7v5j-mph8-9w6g
patch
https://github.com/go-gitea/gitea/pull/39501
patch
https://github.com/go-gitea/gitea/pull/39507
release-notes
https://blog.gitea.com/release-of-28.1.0/
release-notes
https://github.com/go-gitea/gitea/releases/tag/v28.1.0
More from Gitea
9.8
CVE-2026-60004
Gitea Code Injection Vulnerability
9.8
CVE-2026-59774
Gitea Org-mode file disclosure and code execution
9.8
CVE-2026-73278
Gitea WebAuthn bypass during OAuth and OIDC sign-in
9.8
CVE-2026-94205
Gitea fork workflow approval bypass through maintainer-triggered events
9.8
CVE-2022-42968
Gitea before 1.17.3 does not sanitize and escape refs in the git backend