diff --git a/modules/markup/html_commit.go b/modules/markup/html_commit.go
index c319374a38..2fac760674 100644
--- a/modules/markup/html_commit.go
+++ b/modules/markup/html_commit.go
@@ -75,6 +75,11 @@ func anyHashPatternExtract(s string) (ret anyHashPatternResult, ok bool) {
 	}
 
 	ret.CommitID = s[m[pos]:m[pos+1]]
+	// For abbreviated hashes (< 40 chars), only match commit URLs to avoid
+	// false positives like "http://host/org/repo/src/main/20260304.txt"
+	if len(ret.CommitID) < 40 && !strings.HasSuffix(s[ret.PosStart:m[pos]], "/commit/") {
+		return ret, false
+	}
 	pos += 2
 
 	ret.CommitExt = s[m[pos]:m[pos+1]]
diff --git a/modules/markup/html_internal_test.go b/modules/markup/html_internal_test.go
index 34d18de2cb..04694df5e5 100644
--- a/modules/markup/html_internal_test.go
+++ b/modules/markup/html_internal_test.go
@@ -382,6 +382,9 @@ func TestRegExp_anySHA1Pattern(t *testing.T) {
 		"https://github.com/jquery/jquery/commit/0705be4": {
 			CommitID: "0705be4",
 		},
+		// short hex strings in non-commit URLs should not match
+		"http://localhost:3000/foo/bar/src/main/20260304.txt":  {},
+		"http://localhost:3000/foo/bar/blob/main/abcdef1/file": {},
 		"non-url": {},
 		"http://a/b/c/d/e/1234567812345678123456781234567812345678123456781234567812345678?a=b#L1-L2": {
 			CommitID:  "1234567812345678123456781234567812345678123456781234567812345678",