SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityDeferred

CVE-2026-28705

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

MEDIUM 5.3EPSS 0.45%

Does this matter?

Lower severity and a low EPSS score (0.45%). Track it; it rarely justifies an emergency change on its own.

Description

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

CVSS 3.1
5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS
0.45% probability · 38th percentile
CISA KEV
Not listed
Weakness
CWE-22
Source
88ee5874-cf24-4952-aea0-31affedb7ff2

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.