Gitea Path Traversal in Release Asset Dumping

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Gitea Limited

Description

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-28705

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 1.25.5 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Gitea versions before 1.25.5. It involves the use of release tag names and asset names as filesystem path components when dumping release assets. Because these names are used directly as parts of filesystem paths, specially crafted names can manipulate the output paths during the dump process.

Impact Analysis

The vulnerability allows an attacker to influence the filesystem paths used when dumping release assets by using specially crafted release tag or asset names. This could potentially lead to unauthorized file writes or overwrites in unintended locations on the filesystem, which may compromise system integrity or lead to data loss.

Hi! I’m here to help you understand CVE-2026-28705. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70