Gitea CVE-2026-25718

Exploitation requires the Gitea template repository generation feature to be used: the attacker must be able to supply or control the contents of a template repository (planting a symlinked directory or non-regular file), and then invoke repository generation from that template. This normally requires an authenticated Gitea account with permission to create/own a template repository and to generate a new repository from it; on instances with open registration that barrier is low, whereas instances that disable self-registration or restrict repository creation to trusted users substantially limit exploitation. It affects all versions before 1.25.5 on any platform; note the official vector states PR:N but the feature mechanics realistically imply an authenticated, template-controlling actor, so treat PR:N with caution.

The signals are mixed and should be read together rather than off the raw 9.1. The CVSS vector (AV:N/AC:L/PR:N/UI:N) claims fully remote, unauthenticated, low-complexity exploitation, and SSVC marks the issue automatable with total technical impact - pointing to a serious flaw. However, EPSS is very low (0.17%, 7th percentile) and SSVC exploitation is 'none', with no KEV listing and no public exploit identified, indicating no observed real-world attacks yet. There is also tension between the PR:N in the official vector and the actual mechanics: template repository generation is a feature invoked by a logged-in user creating a repository from a template, and the attack requires controlling the contents of a template repo, which realistically implies at least an authenticated account and the ability to craft or influence a template - so the effective privilege requirement is likely PR:L rather than PR:N. The tags label this 'Information Disclosure', but the code (WriteRegularPathFile) and CVSS I:H show it is both read AND write, making integrity impact real, not just disclosure. Net assessment: a genuinely high-severity, patch-worthy bug for any multi-user or public-registration Gitea instance, but current exploitation risk is low and likely to be targeted rather than mass-exploited.

An attacker with an account on a multi-user Gitea instance creates a template repository whose tree contains a symlinked directory or file pointing outside the repository root, then triggers the 'generate repository from template' operation. During generation Gitea follows the symlink and either reads a sensitive server-side file into the new repository (disclosure) or writes attacker-controlled content to an unintended location (integrity). No public exploit code is identified at time of analysis, but the low attack complexity and automatable nature make weaponization plausible.