PT-2026-55606 · Gitea · Gitea Open Source Git Server

Robert Flosbach · Publicado 2026-07-03 · Atualizado 2026-07-03 · CVE-2026-28705

Mitre

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2026-28705

Produtos afetados

Gitea Open Source Git Server

Referências · 5

• https://github.com/go-gitea/gitea/pull/36799 · Correção
• https://github.com/go-gitea/gitea/pull/36839 · Correção
• https://github.com/go-gitea/gitea/releases/tag/v1.25.5 · Nota
• https://blog.gitea.com/release-of-1.25.5 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-28705 · Nota de Segurança