CVE-2026-28705CWE-22

Gitea repository dumps write release assets using unsafe path names

Medium · published July 3, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
38.2
In the wild
Unconfirmed
What it is

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00451 · 38.2th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-07-03T20:19Z
EPSS history
Timeline
  • 03 JUL 20:19Z
    Gitea repository dumps write release assets using unsafe path names
    cvelistv5