CVE-2026-28705 — Gitea repository dumps write release assets using unsafe path names
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump out…
Published: 2026-07-03 · CVSS: 5.3 · CVSS 3.1
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7