What is the CVSS score of CVE-2026-28705?

CVE-2026-28705 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-28705?

Yes, a patch is available for CVE-2026-28705. Update the affected software to the latest version immediately.

Gitea CVE-2026-28705

EUVD-2026-41641 MEDIUM

Path Traversal (CWE-22)

2026-07-03 Gitea

GHSA-7jvx-g65v-r899

Gitea Path Traversal Gitea Open Source Git Server

5.3

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

4.6 MEDIUM

Creating releases requires authenticated write access (PR:L); a separate actor must trigger the dump (UI:R); path traversal affects both file write destination (I:L) and potential exposure of adjacent content (C:L).

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 22, 2026 - 18:31 vuln.today

Analysis Generated

Jul 22, 2026 - 18:31 vuln.today

CVE Published

Jul 03, 2026 - 20:19 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

AnalysisAI

Path traversal in Gitea's release asset dump functionality (all versions before 1.25.5) allows attackers who can create releases with malicious tag or asset names to influence where dump output files are written on the server filesystem. The root cause - confirmed by reviewed PR diffs - is that dump.go passed user-controlled release.TagName and asset.Name directly into filepath.Join() without sanitization. No public exploit or active exploitation has been identified; EPSS is 0.18% (8th percentile) and SSVC confirms exploitation status as none.

Technical ContextAI

The vulnerable code resides in services/migrations/dump.go, where Gitea constructs filesystem paths for dumped release assets using filepath.Join('release_assets', release.TagName) and filepath.Join(attachDir, asset.Name). Because TagName and asset.Name are user-supplied strings never validated for path traversal sequences such as '../', a specially crafted name can redirect dump output outside the intended directory. The affected product is Gitea Open Source Git Server (CPE: cpe:2.3:a:gitea:gitea_open_source_git_server:*:*:*:*:*:*:*:*) in all versions from 0 up to 1.25.5. The root cause is CWE-22 (Improper Limitation of a Pathname to a Restricted Directory - Path Traversal), a classic failure to sanitize user input before using it in filesystem operations. The upstream fix, confirmed via PRs #36799 and #36839, replaces both TagName and asset.Name with uuid.New().String() values, severing the link between user-controlled input and file paths entirely.

RemediationAI

Upgrade to Gitea version 1.25.5 or later; this is a vendor-released patch confirmed by the official release tag and blog post. The fix is implemented via PRs #36799 (https://github.com/go-gitea/gitea/pull/36799) and #36839 (https://github.com/go-gitea/gitea/pull/36839), both of which replace user-controlled names with UUID strings in dump path construction. For organizations unable to patch immediately, restricting or disabling access to Gitea's repository dump and migration endpoints is the most targeted compensating control, though this will impact backup and repository transfer workflows. Additionally, auditing existing repositories for release tag names and asset names containing path traversal patterns (e.g., sequences with '../' or absolute path prefixes) can identify prior exposure before patching.