https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 20:37:39 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-95106 <p>Gitea accepted pushed Git trees containing two entries with the same name, which Git&#39;s own consistency checks reject. Gitea&#39;s web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.</p> <p>Gitea accepted pushed Git trees containing two entries with the same name, which Git&#39;s own consistency checks reject. Gitea&#39;s web views resolved such a path to the first entry, while `git checkout`, Gitea Actions, and release archives use the last. A contributor could open a pull request whose diff and file views show benign content while CI and checkouts at the same commit use different, attacker-controlled content. Incoming objects are now checked for consistency; objects already stored in existing repositories are not rescanned.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-95106