How AI contributed: Incomplete remediationPublished Jun 23, 2026 in 
gogs/gogs
Summary Git LFS storage is content-addressed by OID alone (<LFS-root>/<oid[0]>/<oid[1]>/<oid>) but per-repo authorization lives in the lfs_object table keyed (repo_id, oid). serveUpload skips re-uploading when the OID file already exists on disk and inserts a new (repo_id, oid) row pointing at it without verifying the request body hashes to the OID being claimed. Any user with write access to one repo can bind their repo to an OID owned by a private repo and download the original bytes via their own download endpoint. Details Dedupe shortcut at internal/lfsx/storage.go:79-82: Hash verification at internal/lfsx/storage.go:106-108 only runs in the *new-file* branch — the dedupe path returns earlier. serveUpload (internal/route/lfs/basic.go:78-114) trusts that success and inserts the per-repo binding: CreateLFSObject is an unconditional INSERT on (repo_id, oid) with no check that the OID is referenced by the requesting repo's git history. serveDownload at internal/route/lfs/basic.go:42-72 only consults the per-repo row, then streams from the shared content-addressed file. Suggested fix 1. In LocalStorage.Upload, when os.Stat(fpath) == nil, hash the request body via io.TeeReader and ErrOIDMismatch on disagreement — same code path as the new-file branch already uses. The "client retries after partial failure" use case still works; the retry just has to send the correct content. 2. Optional second layer: in serveUpload, refuse CreateLFSObject unless the OID is referenced by an LFS pointer in the requesting repo's refs. PoC Tested against gogs at HEAD d7571322 (also reproduces on v0.14.2, paths are internal/lfsutil/storage.go and identical logic). Reproduction prerequisites · Running gogs ≥ 0.12.0 with [lfs] ENABLED = true. · Two accounts: alice (private repo secrets) and bob (any repo bob/scratch); bob has no access to alice/secrets. · An OID known to be present in alice/secrets — leaked LFS pointer file in any public ancestor commit, stale fork, support ticket, or any side channel. Brute force is infeasible (256-bit). Setup (testbed simulation of the victim's prior state) Attack — bob has only $OID, not $VICTIM_BYTES Independent confirmation against the source Impact · Cross-tenant disclosure of any LFS object on the instance. Attacker needs HTTP write to one repo + knowledge of a target OID; storage path is global, no per-repo isolation. · LFS commonly stores certificates/keys, firmware blobs, ML model weights, datasets containing PII, packaged installers — all extracted byte-for-byte. · Persistent: the (bob/scratch, OID) row pins read access until manually deleted; removing bob's repo write access does not revoke prior binds. No artefact on victim's side beyond a 200 in the LFS access log.
The Claude-assisted dedupe shortcut in internal/lfsutil/storage.go Upload drained the body with io.Copy(io.Discard, rc) and returned success whenever the OID file already existed, so the upload was never hashed against the claimed OID. serveUpload then created the per-repo (repo_id, oid) binding, letting any repository writer claim an OID owned by a private repository, and the fix streams the body through SHA-256 and returns ErrOIDMismatch.
Case facts
ClaudeThe highlighted steps are this advisory: the incomplete AI patch and the later commit that closed it.
This advisoryCVE-2026-52812 (GHSA-6P9M-Q3JP-47H4)
AI tried to fix this
The AI-assisted change was a real security patch, but it left the same advisory reachable.
Missed: Left the existing-object deduplication shortcut without a content-to-OID hash binding.
Fixed again
This is the patch that actually stops the same attack path.
diff --git a/internal/lfsutil/storage.go b/internal/lfsutil/storage.goindex 36c4d7ac6..2975708e4 100644--- a/internal/lfsutil/storage.go+++ b/internal/lfsutil/storage.go@@ -1,6 +1,8 @@ package lfsutil import (+ "crypto/sha256"+ "encoding/hex" "io" "os" "path/filepath"@@ -11,6 +13,7 @@ import ( ) var ErrObjectNotExist = errors.New("Object does not exist")+var ErrOIDMismatch = errors.New("content hash does not match OID") // Storager is an storage backend for uploading and downloading LFS objects. type Storager interface {@@ -72,16 +75,37 @@ func (s *LocalStorage) Upload(oid OID, rc io.ReadCloser) (int64, error) { if err != nil { return 0, errors.Wrap(err, "create directories") }- w, err := os.Create(fpath)++ w, err := os.OpenFile(fpath, os.O_CREATE|os.O_EXCL|os.O_WRONLY, 0666) if err != nil {+ if os.IsExist(err) {+ // The file was already written by a previous upload (possibly for a+ // different repo). Since the OID is a content hash, the existing file+ // is guaranteed to have the correct content. Drain the reader and+ // return the existing file's size.+ _, _ = io.Copy(io.Discard, rc)+ fi, statErr := os.Stat(fpath)+ if statErr != nil {+ err = errors.Wrap(statErr, "stat existing file")+ return 0, err+ }+ err = nil+ return fi.Size(), nil+ } return 0, errors.Wrap(err, "create file") } defer w.Close() - written, err := io.Copy(w, rc)+ hash := sha256.New()+ written, err := io.Copy(w, io.TeeReader(rc, hash)) if err != nil { return 0, errors.Wrap(err, "copy file") }++ if computed := hex.EncodeToString(hash.Sum(nil)); computed != string(oid) {+ err = ErrOIDMismatch+ return 0, err+ } return written, nil } diff --git a/internal/lfsutil/storage.go b/internal/lfsutil/storage.goindex b53522f10..b082fbcf2 100644--- a/internal/lfsutil/storage.go+++ b/internal/lfsutil/storage.go@@ -77,2 +77,4 @@ func (s *LocalStorage) Upload(oid OID, rc io.ReadCloser) (int64, error) {- // If the object file already exists, skip the upload and return the- // existing file's size.@@ -80 +82,7 @@ func (s *LocalStorage) Upload(oid OID, rc io.ReadCloser) (int64, error) {- _, _ = io.Copy(io.Discard, rc)+ hash := sha256.New()+ if _, err := io.Copy(hash, rc); err != nil {+ return 0, errors.Wrap(err, "read request body")+ }+ if computed := hex.EncodeToString(hash.Sum(nil)); computed != string(oid) {+ return 0, ErrOIDMismatch+ }AI-assisted change ec1892786e029820e86bf8658f4dc9577d3fd7fd2a461a5a23dada7ca31a6bdf · Fix 31565c35651e94f17317a43f9b3ffac0e12a17b2c3314437321bdd24795fde17