Gitea release asset dumps permit path traversal through crafted names
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-28705US | — | — | ||
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://blog.gitea.com/release-of-1.25.5WEB
- https://github.com/go-gitea/giteaPACKAGE
- https://github.com/go-gitea/gitea/commit/833304ac15bce17d0f03c4852af5f60c186f6a70WEB
- https://github.com/go-gitea/gitea/commit/f7ac5076711af3a260f3f98b2c1f8c19b32f6d09WEB
- https://github.com/go-gitea/gitea/pull/36799WEB
- https://github.com/go-gitea/gitea/pull/36839WEB
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5WEB
- https://nvd.nist.gov/vuln/detail/CVE-2026-28705ADVISORY
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan