CVE-2026-86684: Gitea push mirror local path check uses the repository owner
The Gitea push mirror API checked whether the repository owner, instead of the requesting user, may use local file system paths. On instances with [security] IMPORTLOCALPATHS = true, a repository administrator who is not allowed to import local paths could add a push mirror to a local path on the server when the repository owner has that permission. Gitea then pushed the repository's refs into an existing Git repository at that path with the permissions of the Gitea process.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Instances are affected only when [security] IMPORT_LOCAL_PATHS is enabled. Exploitation also requires a repository owner that has permission to use local file system paths and a repository administrator who does not have that permission.
What access does an attacker need?
The attacker needs repository administrator access to add a push mirror. They can then configure a mirror targeting an existing Git repository at a local server path when the repository owner is permitted to use local paths.
What is the impact of a successful exploit?
Gitea pushes the repository's refs into the target Git repository on the server. That push is performed with the permissions of the Gitea process.
What mitigation is available if a fix cannot be applied immediately?
Disable [security] IMPORT_LOCAL_PATHS to prevent use of local file system paths for this scenario.