CVE-2026-28705— Gitea repository dumps write release assets using unsafe path names
Possible ATT&CK Techniques 1AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server | < 1.25.5 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-28705
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea repository dumps write release assets using unsafe path names
Source: NVD (National Vulnerability Database)
Vulnerability Description
Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Vulnerability Title
Gitea 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Gitea是Gitea组织开源的一个基于Go开发的轻量型git服务。 Gitea 1.25.5之前版本存在路径遍历漏洞，该漏洞源于转储发布资源时，将发布标签名称和资源名称用作文件系统路径组件，允许特制名称影响转储输出路径。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Gitea | Gitea Open Source Git Server | 0 ~ 1.25.5 | - |
II. Public POCs for CVE-2026-28705
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-28705
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-28705 (1)
Security Blog Posts for CVE-2026-28705 (1)
Vendor Pages for CVE-2026-28705 (1)
Same Patch Batch · Gitea · 2026-07-03 · 40 CVEs total
| CVE-2026-20896 | 9.8 CRITICAL | Gitea Docker image trusts spoofable reverse-proxy headers by default |
| CVE-2026-58426 | 9.6 CRITICAL | Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read |
| CVE-2026-22874 | 9.6 CRITICAL | Gitea webhook and migration allow-list filtering permits SSRF |
| CVE-2026-58424 | 8.9 HIGH | Permanent Fork PR Workflow Approval Gate Bypass |
| CVE-2026-28737 | 8.7 HIGH | Gitea 3D file viewer allows stored XSS through glTF extensionsRequired |
| CVE-2026-26231 | 8.5 HIGH | Gitea maintainer-edit permissions allow unauthorized commits to readable repositories |
| CVE-2026-28699 | 8.1 HIGH | Gitea Basic Auth bypasses OAuth2 access token scopes |
| CVE-2026-28744 | 8.1 HIGH | Gitea Git smart HTTP bypasses repository token scopes for bearer tokens |
| CVE-2026-22555 | 8.1 HIGH | Gitea organization forks can expose organization secrets without create permission |
| CVE-2026-58423 | 7.7 HIGH | LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to pr |
| CVE-2026-28740 | 7.1 HIGH | Gitea LFS object reuse bypasses Code-unit authorization |
| CVE-2026-20779 | 7.1 HIGH | Gitea TOTP single-use enforcement defect allows OTP replay |
| CVE-2026-58418 | 6.5 MEDIUM | SSRF via HTTP Redirect in Repository Migration |
| CVE-2026-27783 | 4.3 MEDIUM | Gitea issue-template APIs bypass repository unit authorization |
| CVE-2026-27761 | 4.3 MEDIUM | Gitea repository feeds bypass API token scope enforcement |
| CVE-2026-25714 | 4.3 MEDIUM | Gitea user organization API bypasses public-only token filtering |
| CVE-2026-20706 | Gitea repository archive downloads bypass token scope checks | |
| CVE-2026-20909 | Gitea tracked-time list endpoint has insufficient permission checks | |
| CVE-2026-58421 | Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service | |
| CVE-2026-58419 | Notification API leaks private issue metadata after access revocation |
Showing top 20 of 40 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Gitea Open Source Git Server
- CVE-2026-58426
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows - CVE-2026-58423
LFS authentication bypass via malformed SSH sub-verb allows - CVE-2026-58424
Permanent Fork PR Workflow Approval Gate Bypass - CVE-2026-58422
Improper authorization on OAuth sign-in callback silently re - CVE-2026-58421
Unauthenticated ReDoS via CODEOWNERS pattern matching allows
Same vendor: Gitea
- CVE-2026-58423
LFS authentication bypass via malformed SSH sub-verb allows - CVE-2026-58426
Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows - CVE-2026-58424
Permanent Fork PR Workflow Approval Gate Bypass - CVE-2026-58421
Unauthenticated ReDoS via CODEOWNERS pattern matching allows - CVE-2026-58422
Improper authorization on OAuth sign-in callback silently re
Same weakness: CWE-22
- CVE-2026-54760
Langroid: SQLChatAgent dangerous-function blocklist can be b - CVE-2026-50181
Langroid: Path traversal in the file tools allows read/write - CVE-2026-50180
Langroid: SQLChatAgent _validate_query blocklist misses pg_r - CVE-2026-59832
SiYuan: Authenticated path traversal in /snippets/ static ha - CVE-2026-13492
UsersWP <= 1.2.65 - Authenticated (Subscriber+) Arbitrary Fi
V. Comments for CVE-2026-28705
No comments yet