CVE-2026-44647CWE-22

OneDev: Path Traversal (read capability via Git LFS pointer resolution)

High · published May 14, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
36.9
In the wild
Unconfirmed
What it is

OneDev is a Git server with CI/CD, kanban, and packages. Prior to 15.0.2, there is behavior that breaks the expected boundary between repository-controlled LFS metadata and server-local filesystem paths. A repository object can steer raw blob reads to arbitrary local files that the server account can access. User with push permission to any repository will be able to access any server files accessible by server process. This vulnerability is fixed in 15.0.2.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00437 · 36.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-05-14T20:08Z
EPSS history
Timeline
  • 14 MAY 20:08Z
    OneDev: Path Traversal (read capability via Git LFS pointer resolution)
    cvelistv5