CVE-2026-28705

Description

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

PUBLISHED Reserved 2026-03-03 | Published 2026-07-03 | Updated 2026-07-07 | Assigner Gitea

Problem types

Improper Limitation of a Pathname to a Restricted Directory

Product status

Credits

Robert Flosbach from Neodyme AG reporter

References

github.com/go-gitea/gitea/pull/36799 (GitHub Pull Request #36799) patch

github.com/go-gitea/gitea/pull/36839 (GitHub Pull Request #36839) patch

github.com/go-gitea/gitea/releases/tag/v1.25.5 (Gitea v1.25.5 Release) release-notes

blog.gitea.com/release-of-1.25.5/ (Gitea v1.25.5 Release Blog Post) release-notes

cve.org (CVE-2026-28705)

nvd.nist.gov (CVE-2026-28705)

Download JSON