CVE-2026-28705

Gitea repository dumps write release assets using unsafe path names

CVSS 5.3 MEDIUMEPSS 0.4%CWE-22

Vexday Risk Score

13Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 5.3EPSS 0.4%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

03 Jul 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected products

Gitea · Gitea Open Source Git Server

References

https://blog.gitea.com/release-of-1.25.5/https://github.com/go-gitea/gitea/pull/36799 https://github.com/go-gitea/gitea/pull/36839 https://github.com/go-gitea/gitea/releases/tag/v1.25.5