Gitea LFS mirror operations bypass migration HTTP transport protections
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS requests.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-26292US | — | — | ||
Gitea versions before 1.25.5 do not use the migration HTTP transport for LFS push and sync mirror operations, bypassing the configured migration transport protections for those LFS… | ||||
02
references
External citations — patches, advisories, analysis.
- https://blog.gitea.com/release-of-1.25.5WEB
- https://github.com/go-gitea/giteaPACKAGE
- https://github.com/go-gitea/gitea/commit/996cc12bf7d54ae2326f20b4211fff70eb31e74aWEB
- https://github.com/go-gitea/gitea/commit/bcd253a310115045d3ec5e8168a953fbee34dd28WEB
- https://github.com/go-gitea/gitea/pull/36665WEB
- https://github.com/go-gitea/gitea/pull/36691WEB
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-26292ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan