CVE-2026-25718 | Gitea versions before 1.25.5 mishandle path resolution durin…

Description

Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.

Metadata

CVE ID: CVE-2026-25718
State: PUBLISHED
Assigner: Gitea
Reserved: 2026-02-22 15:13 UTC
Published: 2026-07-03 20:19 UTC
Last updated: 2026-07-03 20:19 UTC
Primary CWE: CWE-59
Improper Link Resolution Before File Access ('Link Following…
Vendor / Product: Gitea / Gitea Open Source Git Server
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
Gitea	Gitea Open Source Git Server	—	0 < 1.25.5

Weakness (CWE)

CWE	Source	Description
CWE-59	cna	Improper Link Resolution Before File Access ('Link Following')

References (4)

GitHub Pull Request #36734 https://github.com/go-gitea/gitea/pull/36734
GitHub Pull Request #36746 https://github.com/go-gitea/gitea/pull/36746
Gitea v1.25.5 Release https://github.com/go-gitea/gitea/releases/tag/v1.25.5
Gitea v1.25.5 Release Blog Post https://blog.gitea.com/release-of-1.25.5/