A vulnerability exists where Gitea accepts pushed Git trees containing duplicate entries with identical names. Git itself rejects such objects, but Gitea's internal logic does not enforce consistency for existing repositories. This mismatch enables the web interface to display one version of a file while tools such as git checkout, Actions, and release archives provide a different, attacker-controlled version. The condition permits malicious content to be introduced into CI pipelines or release artifacts, effectively enabling remote code execution in environments that consume the repository.

The affected products are Gitea repositories hosted on instances running versions prior to 28.0.0.0 and later add consistency checks for incoming objects. This includes any users who host projects on those instances and have the ability to push or create pull requests. The exact affected versions cannot be enumerated from the data, but the fix was introduced in 28.0.0, implying that earlier releases are impacted.

The vulnerability is exploitable over any interface that accepts pushes, such as HTTP or SSH, and the attack vector is inferred to be a normal Git push or pull request. The EPSS score indicates < 1% probability of exploitation, and the vulnerability is not listed in CISA's KEV, so no widespread exploitation has been reported. Nonetheless, the description indicates the potential for code execution and push-based exploitation, but due to lack of official metrics, the likelihood and overall risk level cannot be precisely quantified. The CVSS base score of 9.1 indicates high severity.