Answer in brief
CVE-2026-123638 records a Unknown severity vulnerability in Gitea protected file pattern bypass with quoted file names. The current sources do not mark it as known exploited. The current feed maps Gitea/Gitea (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Gitea/Gitea (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Gitea/Giteageneric | >=0 <28.4.0 | 28.4.0 |
Published upstream
Nov 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 15, 2026
The "Protected file patterns" setting of a branch protection rule was checked against file names as git prints them, and git quotes names that contain a double quote, a backslash or a control character. Such names never matched a pattern, so a user with write access could add or change files under a protected pattern by direct push or through a pull request merge, and could move a protected file out of the pattern's reach by renaming it. Where the patterns protect workflow files, this allowed adding a workflow that then ran on the repository's runners. Changed files are now listed unquoted, and a rename reports both the old and the new path.
Quoted source text, attributed separately from HOL analysis.