CVE-2026-28705: Gitea Open Source Git Server

Medium severity, CVSS 5.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

Affected products

• Gitea Gitea Open Source Git Server: before 1.25.5 (fixed in 1.25.5)

Published 2026-07-03. Last modified 2026-07-07.