PT-2026-50789 · Theonedev · Onedev

Published 2026-06-18 · Updated 2026-06-18 · CVE-2026-49248

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions OneDev versions prior to 15.0.7

Description An arbitrary file write issue exists due to symlink path traversal. The TarUtils.untar() function creates symbolic links using the getLinkName() TAR entry without validating if the target is an absolute path. A subsequent file entry within the same archive can traverse this symlink to write to arbitrary server-side locations. This can be exploited by any authenticated user with CI Job write access without requiring administrator interaction.

Recommendations Update to version 15.0.7.

Fix

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2026-49248

Affected Products

Onedev

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-49248 · Security Note
• https://github.com/theonedev/onedev/security/advisories/GHSA-55g8-94r5-cj37 · Note
• https://github.com/theonedev/onedev/commit/4f8684acebc4bfeefd3c7e23a34a4fd591cb27ad · Note
• https://twitter.com/VulmonFeeds/status/2067735003002175910 · Twitter Post