CVE-2026-120991

Gitea deletion of shared container blobs on rejected uploads

View on CVE.org
Published Nov 15, 2026 CVSS n/a EPSS n/a KEV · Not listed
Description
When a container blob upload was rejected, for example because it exceeded a package size quota, the cleanup removed the blob from storage even if the same content already existed and was used by other packages. On an instance with a package quota configured, a user who can upload container images and has the exact content of another owner's package file or image layer could make it undownloadable. The cleanup now only removes blobs that the failed upload created.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Description When a container blob upload was rejected, for example because it exceeded a package size quota, the cleanup removed the blob from storage even if the same content already existed and was used by other packages. On an instance with a package quota configured, a user who can upload container images and has the exact content of another owner's package file or image layer could make it undownloadable. The cleanup now only removes blobs that the failed upload created.
Title Gitea deletion of shared container blobs on rejected uploads
Weaknesses CWE-460
References

Subscriptions

No data.

Weaknesses

Sources

Status
PUBLISHED
Assigner
Gitea
Published
Updated
Nov 15, 2026, 9:13 PM
Reserved
Nov 15, 2026, 8:31 PM

View source JSON

No data.

No data.

No data.

No data.