Gitea EUVD-2026-41641

Two specific conditions must be met: first, the attacker must possess authenticated write access to a Gitea repository in order to create a release with a malicious tag name or asset name containing path traversal sequences; second, a dump or migration operation must be separately triggered against that repository - this is not part of normal repository browsing or API interaction and typically requires an administrator or automation to invoke it. The CVSS PR:N assignment is inconsistent with the authentication requirement for creating Gitea releases (contributor-level write access is required at minimum); this discrepancy is unresolved. Exploitation is strictly scoped to the dump and migration workflow - the standard repository hosting, code review, issue tracking, and CI/CD features are unaffected. The filesystem impact is further constrained to paths accessible under the OS user running the Gitea dump process.

The NVD-assigned CVSS 5.3 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) classifies this as a moderate-severity, network-accessible, unauthenticated issue, but the PR:N and UI:N assignments conflict with the practical exploitation requirements: creating releases in Gitea requires repository write access (authenticated), and a dump operation must be separately triggered by another actor - this discrepancy is unresolved and should be verified with the vendor. EPSS at 0.18% (8th percentile) indicates very low observed exploitation probability, consistent with SSVC Exploitation: none and Technical Impact: partial. SSVC flags Automatable: yes, meaning that if malicious repositories exist on a target instance, a scanner could probe dump endpoints at scale; however, real-world risk is constrained to organizations actively using Gitea's dump or migration workflows. The vulnerability does not affect normal repository browsing, code review, or CI/CD operations. Overall, this warrants routine patching rather than emergency response - EPSS, KEV absence, and SSVC all align on low near-term exploitation risk.

An authenticated attacker with repository write access creates a Gitea release whose tag name or asset name contains a path traversal sequence such as '../../var/spool/cron/attacker'. When an administrator or automated backup process subsequently triggers a repository dump against that repository, Gitea's dump.go constructs the output path using the malicious string, potentially writing dump artifacts to an attacker-chosen location on the server filesystem. No public proof-of-concept has been identified at the time of analysis.