CVE-2026-28705 json
Gitea repository dumps write release assets using unsafe path names
published 4mo ago modified 15d ago also GHSA-7jvx-g65v-r899 , GO-2026-6337 , EUVD-2026-41641
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.
Patch / fix
- go code.gitea.io/gitea 1.25.5
- Gitea Gitea Open Source Git Server 1.25.5
- govulncheck-vulndb SLES 16.0, SLES for SAP applications 16.0 0.0.20260902T191204-160000.1.1
suse advisories SUSE-SU-2026:23692-1SUSE-SU-2026:23712-1
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260902T191204-160000.1.1
opensuse advisories openSUSE-SU-2026:21812-1
- github.com/go-gitea/gitea@833304a commit
- github.com/go-gitea/gitea@f7ac507 commit
- github.com/go-gitea/gitea#36799 pull request
- github.com/go-gitea/gitea#36839 pull request
- github.com/go-gitea/gitea/releases/tag/v1.25.5 release
Is CVE-2026-28705 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 4mo ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | code.gitea.io/gitea | <1.25.5 |
1.25.5 |
Affected products
- Gitea Gitea Open Source Git Server
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/go-gitea/gitea/pull/36799
patch, web
-
github.com
/go-gitea/gitea/pull/36839
patch, web
-
github.com
/go-gitea/gitea/commit/833304ac15bce17d0f03c4852af5f60c186f6a70
web
-
github.com
/go-gitea/gitea/commit/f7ac5076711af3a260f3f98b2c1f8c19b32f6d09
web
-
github.com
/go-gitea/gitea/releases/tag/v1.25.5
release-notes, web
-
blog.gitea.com
/release-of-1.25.5/
release-notes
-
nvd.nist.gov
/vuln/detail/CVE-2026-28705
advisory
-
blog.gitea.com
/release-of-1.25.5
web
-
github.com
/go-gitea/gitea
package
-
github.com
/advisories/GHSA-7jvx-g65v-r899
advisory
Sources
- CVE List CVE-2026-28705
- GitHub Advisory GHSA-7jvx-g65v-r899
- NVD CVE-2026-28705
- OSV GO-2026-6337
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.