CVE-2026-28705 | Gitea versions before 1.25.5 use release tag names and asset…

Description

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

Metadata

CVE ID: CVE-2026-28705
State: PUBLISHED
Assigner: Gitea
Reserved: 2026-03-03 03:25 UTC
Published: 2026-07-03 20:19 UTC
Last updated: 2026-07-03 20:19 UTC
Primary CWE: CWE-22
Improper Limitation of a Pathname to a Restricted Directory
Vendor / Product: Gitea / Gitea Open Source Git Server
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (1)

Vendor	Product	Platform	Versions
Gitea	Gitea Open Source Git Server	—	0 < 1.25.5

Weakness (CWE)

CWE	Source	Description
CWE-22	cna	Improper Limitation of a Pathname to a Restricted Directory

References (4)

GitHub Pull Request #36799 https://github.com/go-gitea/gitea/pull/36799
GitHub Pull Request #36839 https://github.com/go-gitea/gitea/pull/36839
Gitea v1.25.5 Release https://github.com/go-gitea/gitea/releases/tag/v1.25.5
Gitea v1.25.5 Release Blog Post https://blog.gitea.com/release-of-1.25.5/