What is the CVSS score of CVE-2026-25718?

CVE-2026-25718 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of Gitea are affected by CVE-2026-25718?

Gitea before version 1.25.5 contains a critical vulnerability enabling arbitrary read and write of files on affected systems through the template repository feature, potentially exposing sensitive…. A patch is available.

How to fix or mitigate CVE-2026-25718?

Within 24 hours, inventory all Gitea deployments and confirm running versions to identify instances before 1.25.5. Within 7 days, apply the vendor-released patch by upgrading to Gitea 1.25.5 or later across all instances, prioritizing systems with template repository generation enabled. Within 30 days, verify patch deployment across all environments, audit template repositories for suspicious content, review access logs for unauthorized file operations during the vulnerability window, and implement access controls restricting who can create or upload template repositories.

Gitea CVE-2026-25718

EUVD-2026-41624 CRITICAL

Improper Link Resolution Before File Access (CWE-59)

2026-07-03 Gitea

GHSA-h697-89cp-24q8

Information Disclosure Gitea Gitea Open Source Git Server

9.1

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Remote and low-complexity, but requires an authenticated user who controls a template repository to trigger generation, so PR:L; symlink abuse yields file read and write (C:H/I:H) with no availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 18:35 vuln.today

Analysis Generated

Jul 22, 2026 - 18:35 vuln.today

CVE Published

Jul 03, 2026 - 20:19 cve.org

CRITICAL 9.1

CVE Published

Jul 03, 2026 - 20:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.

AnalysisAI

Arbitrary file read and write in Gitea before 1.25.5 arises when the template repository generation feature resolves paths through symlinks or other non-regular file types instead of restricting itself to regular files within the target root. An attacker who controls a template repository can plant symlinked or special paths so that generation reads sensitive files or writes attacker-controlled data outside the intended boundary, yielding high confidentiality and integrity impact (CVSS 9.1). There is no public exploit identified at time of analysis, the EPSS probability is low (0.17%, 7th percentile), and CISA SSVC records exploitation as 'none', but the flaw is automatable with total technical impact.

Technical ContextAI

The vulnerability is a CWE-59 link-following / improper link resolution issue in Gitea's Go codebase, specifically in the path-handling helpers used when Gitea instantiates a new repository from a template repository. The pre-fix logic used os.Lstat only to test whether a final target was a regular file and did not validate that every intermediate path component was a genuine regular directory, so a symlinked directory or symlinked file placed inside the template tree could redirect a read or write to a location the operator did not intend. The upstream fix (PRs 36734 and 36746) replaces the old IsRegularFile check with new ReadRegularPathFile and WriteRegularPathFile helpers that walk each sub-path element, Lstat every component, and reject the operation with ErrNotRegularPathFile if any parent is not a regular directory or the leaf is not a regular file - closing both the symlinked-directory and symlinked-file traversal paths, as the added unit tests (link-dir/real-file, real-dir/link-file, link-dir/link-file) demonstrate. The affected component is the Gitea open-source Git server (CPE cpe:2.3:a:gitea:gitea_open_source_git_server).

RemediationAI

Vendor-released patch: upgrade Gitea to version 1.25.5 or later, which contains the fixes from PRs https://github.com/go-gitea/gitea/pull/36734 and https://github.com/go-gitea/gitea/pull/36746 (see release https://github.com/go-gitea/gitea/releases/tag/v1.25.5 and https://blog.gitea.com/release-of-1.25.5/). Until you can patch, reduce exposure by disabling or restricting the template repository feature and by limiting who can create template repositories and generate repositories from them - restrict repository creation to trusted users and disable open self-registration so untrusted accounts cannot supply malicious templates (trade-off: blocks legitimate self-service onboarding and template-based repo creation). Additionally, ensure the Gitea service account runs with least privilege on the filesystem so that any read/write redirected through a symlink is confined and cannot reach sensitive host files (trade-off: none significant, and it is good hardening regardless).