{"api_version":"1","generated_at":"2026-11-15T23:52:27+00:00","cve":"CVE-2026-120991","urls":{"html":"https://cve.report/CVE-2026-120991","api":"https://cve.report/api/cve/CVE-2026-120991.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-120991","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-120991"},"summary":{"title":"Gitea deletion of shared container blobs on rejected uploads","description":"When a container blob upload was rejected, for example because it exceeded a package size quota, the cleanup removed the blob from storage even if the same content already existed and was used by other packages. On an instance with a package quota configured, a user who can upload container images and has the exact content of another owner's package file or image layer could make it undownloadable. The cleanup now only removes blobs that the failed upload created.","state":"PUBLISHED","assigner":"Gitea","published_at":"2026-11-15 22:17:17","updated_at":"2026-11-15 22:17:18"},"problem_types":["CWE-460","CWE-460 CWE-460: Improper Cleanup on Thrown Exception"],"metrics":[],"references":[{"url":"https://github.com/go-gitea/gitea/pull/40120","name":"https://github.com/go-gitea/gitea/pull/40120","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0","name":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-q8pg-ggp9-rm9m","name":"https://github.com/go-gitea/gitea/security/advisories/GHSA-q8pg-ggp9-rm9m","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://blog.gitea.com/release-of-28.4.0/","name":"https://blog.gitea.com/release-of-28.4.0/","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/40268","name":"https://github.com/go-gitea/gitea/pull/40268","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-120991","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120991","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Gitea","product":"Gitea","version":"affected 1.20.0 28.4.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"https://github.com/silverwind","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"gitea.dev","product":"Gitea","vendor":"Gitea","versions":[{"lessThan":"28.4.0","status":"affected","version":"1.20.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"remediation developer","value":"https://github.com/silverwind"}],"descriptions":[{"lang":"en","value":"When a container blob upload was rejected, for example because it exceeded a package size quota, the cleanup removed the blob from storage even if the same content already existed and was used by other packages. On an instance with a package quota configured, a user who can upload container images and has the exact content of another owner's package file or image layer could make it undownloadable. The cleanup now only removes blobs that the failed upload created."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-460","description":"CWE-460: Improper Cleanup on Thrown Exception","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-15T21:13:54.916Z","orgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","shortName":"Gitea"},"references":[{"name":"GitHub Security Advisory GHSA-q8pg-ggp9-rm9m","tags":["vendor-advisory"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-q8pg-ggp9-rm9m"},{"name":"Fix: go-gitea/gitea pull request #40120","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40120"},{"name":"Fix backport to release/v28: go-gitea/gitea pull request #40268","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40268"},{"name":"Gitea 28.4.0 release announcement","tags":["release-notes"],"url":"https://blog.gitea.com/release-of-28.4.0/"},{"name":"go-gitea/gitea v28.4.0 release","tags":["release-notes"],"url":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0"}],"title":"Gitea deletion of shared container blobs on rejected uploads"}},"cveMetadata":{"assignerOrgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","assignerShortName":"Gitea","cveId":"CVE-2026-120991","datePublished":"2026-11-15T21:13:54.916Z","dateReserved":"2026-11-15T20:31:51.061Z","dateUpdated":"2026-11-15T21:13:54.916Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-15 22:17:17","lastModifiedDate":"2026-11-15 22:17:18","problem_types":["CWE-460","CWE-460 CWE-460: Improper Cleanup on Thrown Exception"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"120991","Ordinal":"1","Title":"Gitea deletion of shared container blobs on rejected uploads","CVE":"CVE-2026-120991","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"120991","Ordinal":"1","NoteData":"When a container blob upload was rejected, for example because it exceeded a package size quota, the cleanup removed the blob from storage even if the same content already existed and was used by other packages. On an instance with a package quota configured, a user who can upload container images and has the exact content of another owner's package file or image layer could make it undownloadable. The cleanup now only removes blobs that the failed upload created.","Type":"Description","Title":"Gitea deletion of shared container blobs on rejected uploads"}]}}}