CVE-2026-28705
Gitea repository dumps write release assets using unsafe path names
- State
- Published
- Severity
- 5.3 Medium
- Published
- Jul 3, 2026
- Updated
- Jul 7, 2026
- Reserved
- Mar 3, 2026
Description
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
Affected Products
| Product | Versions |
|---|---|
Gitea Open Source Git ServerGitea |
|
References
- GitHub Pull Request #36799patch
- GitHub Pull Request #36839patch
- Gitea v1.25.5 Releaserelease-notes
- Gitea v1.25.5 Release Blog Postrelease-notes
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.