Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-49248— OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar

Quick assessment

Affected
theonedev onedev
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

theonedev onedev是theonedev的持续集成/持续部署平台。 Theonedev onedev 15.0.6及之前版本存在后置链接漏洞，该漏洞源于TarUtils.untar()在没有验证目标路径是否为绝对路径的情况下，直接根据TAR条目创建符号链接，后续的文件条目通过该符号链接写入任意服务器端位置，可能导致任意文件写入。

AI Predicted 8.8 Difficulty: Easy EPSS 0.57% · P45

Affected Version Matrix 1

VendorProduct Version RangeStatus
theonedev onedev < 15.0.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-49248

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar
Source: CVE Program / CVE List V5
Vulnerability Description
OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, TarUtils.untar() creates symbolic links verbatim from TAR entry getLinkName() without validating whether the target is an absolute path. A subsequent file entry in the same archive traverses the symlink, writing to arbitrary server-side locations. This is exploitable by any authenticated user with CI Job write access — no admin interaction required. This is an incomplete fix bypass of CVE-2021-21251 (GHSA-2w6j-wc8c-9mq2): that patch blocked .. path segments but did not address absolute symlink targets. This issue has been fixed in version 15.0.7.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-61
Source: CVE Program / CVE List V5
Vulnerability Title
Theonedev onedev 后置链接漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
theonedev onedev是theonedev的持续集成/持续部署平台。 Theonedev onedev 15.0.6及之前版本存在后置链接漏洞，该漏洞源于TarUtils.untar()在没有验证目标路径是否为绝对路径的情况下，直接根据TAR条目创建符号链接，后续的文件条目通过该符号链接写入任意服务器端位置，可能导致任意文件写入。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
theonedev onedev < 15.0.7 -

II. Public POCs for CVE-2026-49248

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-49248

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-49248 (2)

IV. Related Vulnerabilities

Same product: onedev
Same vendor: theonedev
Same weakness: CWE-61

V. Comments for CVE-2026-49248

No comments yet

Leave a comment