CVE-2026-28705: Gitea Path Traversal in Release Assets – CVSS 5.3 Information Disclosure

Technical summary

CVE-2026-28705 is a CWE-22 path traversal vulnerability affecting Gitea before version 1.25.5. The vulnerability exists in the release asset dump functionality, where user-controlled input—specifically release tag names and asset file names—are incorporated into filesystem paths without proper validation or canonicalization. An attacker can use path traversal sequences (such as '../') in a crafted release tag or asset name to escape the intended asset directory and read files from other parts of the filesystem that the Gitea process has permission to access. The CVSS v3.1 score of 5.3 (Medium) reflects low complexity exploitation with network accessibility but limited confidentiality impact and no integrity or availability impact.

Business impact

This vulnerability allows unauthorized information disclosure through the Gitea release asset export mechanism. An attacker with the ability to create or modify releases in a Gitea instance can read sensitive configuration files, credentials, or source code stored on the same server. For organizations using Gitea as a central repository platform, this could expose environment variables, API keys, or proprietary code. The impact is primarily confidentiality; the vulnerability does not enable file modification or deletion. Organizations hosting multiple projects on a single Gitea instance face heightened risk, as one compromised project could leak data from other projects' stored files.

Affected systems

All Gitea installations prior to version 1.25.5 are affected. The vulnerability applies regardless of deployment model (Docker, bare metal, cloud-hosted) or operating system, as it is a logic flaw in Gitea's release asset handling code rather than an OS-specific issue. Self-hosted instances and managed Gitea services running affected versions require patching. Organizations should verify their deployed Gitea version against the vendor advisory to confirm exposure.

Exploitability

Exploitation requires network access to a Gitea instance and the ability to create or modify a release in a repository (which typically requires at least push access to that repository, or admin privileges depending on Gitea configuration). The attack is straightforward once access is gained: craft a release tag or asset name containing path traversal sequences, trigger a release asset dump operation, and observe or retrieve the output to access files outside the release directory. No special tooling or code execution is required; standard Gitea API or web interface interactions suffice. The lack of complexity and authentication requirement at the repository level makes this a practical risk for organizations with multiple internal teams or open-source repositories accepting contributions.

Remediation

Upgrade Gitea to version 1.25.5 or later. This version contains fixes to sanitize release tag names and asset file names, preventing path traversal sequences from affecting dump output paths. Before upgrading, identify all Gitea instances in your environment and their current versions. Plan an upgrade window, backing up repositories and configuration as part of standard procedure. For instances that cannot be upgraded immediately, consider restricting release creation/modification permissions to trusted users and disabling automated release asset dump features if available, though these are temporary mitigations only.

Patch guidance

Verify your Gitea deployment version by accessing the admin dashboard or running 'gitea --version'. Obtain version 1.25.5 or later from the official Gitea release repository. Review the vendor advisory for any version-specific upgrade considerations or breaking changes. Test the upgrade in a non-production environment first. After upgrade, confirm the version change and monitor release asset operations for any unexpected behavior. No database schema changes are expected with this patch, but standard backup procedures should be followed as a precaution.

Detection guidance

Monitor Gitea access logs and audit trails for release creation or modification events containing unusual characters or path traversal sequences ('../', '..\', encoded variants) in release tag names or asset file names. Review filesystem access logs on the Gitea server for unexpected file reads outside the release asset directory, particularly targeting sensitive paths such as configuration directories, .ssh directories, or environment variable storage. Implement alerting on Gitea API calls to the release asset dump endpoint combined with suspicious naming patterns. Conduct a retrospective review of recently created or modified releases to identify any with suspicious names that might indicate past exploitation attempts.

Why prioritize this

CVE-2026-28705 merits prompt but non-emergency patching. The Medium CVSS score and lack of KEV designation reflect limited exploitability in practice: an attacker must already have repository access, and the impact is read-only information disclosure. However, the vulnerability is easy to exploit once access is obtained, and information disclosure can have serious downstream consequences (exposed credentials, leaked source code). Prioritize patching for instances hosting sensitive projects or those with lenient access controls. Organizations with tightly restricted repository permissions and limited internal user bases can defer patching slightly but should not delay beyond standard maintenance windows.

Risk score, explained

The CVSS 3.1 score of 5.3 reflects a network-accessible vulnerability with low attack complexity but constrained impact. The vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) indicates network attack surface, no privilege requirement for path traversal itself, but low confidentiality impact because file access is limited to what the Gitea process can read—typically application files and repository data, though configuration or secrets might be included depending on server hardening. The absence of integrity and availability impact limits the score despite ease of exploitation. The lack of public exploitation code and KEV listing further supports a Medium rather than High classification.

Frequently asked questions