CVE-2026-25718CWE-59

Gitea template repository generation mishandles symlinked paths

Critical · published July 3, 2026

CVSS v3.1
9.1
EPSS
1%
Percentile
46.0
In the wild
Unconfirmed
What it is

Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.

The record
Technical detail
CVSS v3.1
9.1 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00562 · 46.0th percentile
Weakness
CWE-59 · Improper Link Resolution Before File Access ('Link Following')
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea template repository generation mishandles symlinked paths
    cvelistv5