Which versions of OneDev are affected by CVE-2026-49248?

OneDev versions 15.0.6 and earlier contain an arbitrary file-write vulnerability affecting any authenticated user with CI Job access, enabling unauthorized overwriting of system files through a…. A patch is available.

How to fix or mitigate CVE-2026-49248?

Within 24 hours: Inventory all OneDev instances and identify users holding CI Job write permissions; enable enhanced logging on TAR artifact uploads. Within 7 days: Restrict CI Job write access to essential personnel only; enforce MFA on all CI accounts; implement file integrity monitoring on critical server directories. Within 30 days: Monitor GHSA-55g8-94r5-cj37 and vendor advisories for patch availability; upgrade OneDev to patched version immediately upon release; conduct forensic audit of TAR uploads for evidence of exploitation.

OneDev CVE-2026-49248

Q: What is the CVSS score of CVE-2026-49248?

CVE-2026-49248 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-37942 HIGH

UNIX Symbolic Link (Symlink) Following (CWE-61)

2026-06-18 GitHub_M

Authentication Bypass Onedev

8.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable HTTP API, low complexity, requires authenticated user with CI Job write role (PR:L), no user interaction; primitive is arbitrary file write so I:H, with C:N and A:N as direct impacts.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 18, 2026 - 22:16 EUVD

Source Code Evidence Fetched

Jun 18, 2026 - 20:45 vuln.today

Analysis Generated

Jun 18, 2026 - 20:45 vuln.today

DescriptionCVE.org

OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, TarUtils.untar() creates symbolic links verbatim from TAR entry getLinkName() without validating whether the target is an absolute path. A subsequent file entry in the same archive traverses the symlink, writing to arbitrary server-side locations. This is exploitable by any authenticated user with CI Job write access - no admin interaction required. This is an incomplete fix bypass of CVE-2021-21251 (GHSA-2w6j-wc8c-9mq2): that patch blocked .. path segments but did not address absolute symlink targets. This issue has been fixed in version 15.0.7.

AnalysisAI

Arbitrary file write in OneDev 15.0.6 and earlier allows any authenticated user with CI Job write access to overwrite files anywhere on the server filesystem by uploading a crafted TAR archive whose symbolic link entries point to absolute paths outside the extraction directory. The flaw is an incomplete-fix bypass of CVE-2021-21251, which only blocked .. path traversal in TAR entry names but never validated symlink targets. No public exploit has been identified at time of analysis, but the official patch commit and GitHub Security Advisory GHSA-55g8-94r5-cj37 publicly describe the bypass mechanism.

Technical ContextAI

OneDev is a self-hosted Git server with integrated CI/CD, kanban, and package registries written in Java. The vulnerable code path is TarUtils.untar(), which iterates TAR entries and, for entries flagged as symbolic links, creates a symlink on disk using the raw value returned by Apache Commons Compress's TarArchiveEntry.getLinkName() without normalizing or sandboxing the link target. When a later file entry in the same archive is written through that symlink, the write follows the link to an attacker-chosen absolute path. This is a textbook CWE-61 (UNIX Symbolic Link Following) issue and a classic TAR-slip variant: the 2021 fix only sanitized entry names for .. traversal, leaving absolute symlink targets (e.g. /etc/cron.d/x, /opt/onedev/conf/hibernate.properties) unvalidated. The vulnerable CPE is cpe:2.3:a:theonedev:onedev:*:*:*:*:*:*:*:* up through 15.0.6, and the patch commit 4f8684a bumps internal commons and agent module versions to 3.3.1 / 2.5.9 respectively, indicating the hardening lives in those shared utility modules.

RemediationAI

Vendor-released patch: OneDev 15.0.7 - upgrade immediately via the standard OneDev upgrade procedure; the fix is delivered through bumped internal module versions (commons 3.3.1 and agent 2.5.9) per commit 4f8684a, so a partial component update will not suffice and the full 15.0.7 release should be deployed. Where an immediate upgrade is not possible, the most effective compensating control is to restrict CI Job write access to a minimal trusted set of users via OneDev's role/permission system, since exploitation requires that specific permission rather than admin; the trade-off is that legitimate pipeline authors temporarily lose self-service. As a secondary mitigation, run the OneDev server process under a dedicated unprivileged UID with strict filesystem ACLs on its install directory, configuration files, and any mounted CI workspace, and consider AppArmor/SELinux confinement that denies writes outside the OneDev data directory - this blunts the impact of arbitrary file writes but does not prevent overwrite of OneDev's own config or job scripts. Refer to https://github.com/theonedev/onedev/security/advisories/GHSA-55g8-94r5-cj37 for vendor guidance.