CVE-2026-26292
Fixed in a distro release EPSS <1%CVSS 9.8
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
Products: Gitea Open Source Git Server
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | code.gitea.io/gitea | 1.25.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Linux Enterprise Server 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |
| SUSE Linux Enterprise Server for SAP applications 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260916T180043-160000.1.1 |