VulnerabilityDeferred

CVE-2026-26292

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

CRITICAL 9.8EPSS 0.65%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.

CVSS 3.1: 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.65% probability · 49th percentile
CISA KEV: Not listed
Weakness: CWE-284
Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

References

https://blog.gitea.com/release-of-1.25.5/
https://github.com/go-gitea/gitea/pull/36665
https://github.com/go-gitea/gitea/pull/36691
https://github.com/go-gitea/gitea/releases/tag/v1.25.5

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.