GitHub Advisoryadvisory · Go

GHSA-7jvx-g65v-r899 Gitea release asset dumps permit path traversal through crafted names

MEDIUM Published 2026-07-03 Modified 2026-09-01 Official page ↗
Aliases
CVE-2026-28705
Ecosystem
Go
Packages
code.gitea.io/gitea
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22
Reviewed
2026-09-01

Affected packages

• Go code.gitea.io/gitea: < 1.25.5 → fixed in 1.25.5

Description

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

Related

Alias · CVE (1)

  • CVE-2026-28705 Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References