CVE-2026-28705

MediumCVSS 5.3/10Last modified Oct 25, 2026

Description

Gitea versions before 1.25.5 use release tag names and asset names as filesystem path components when dumping release assets, allowing specially crafted names to affect dump output paths.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-22

Affected software

No affected versions have been published.

Timeline

Published
Jul 3, 2026
Last modified
Oct 25, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-287075.4Protection mechanism failure for some LLM-on-Ray before version 1.0 within Ring 3: User Applications may allow an escalation of privilege. UCVE-2026-287094.3Unauthorized resource manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (LinuCVE-2026-28718.8A weakness has been identified in Tenda A21 1.0.0.0. This affects the function fromSetIpMacBind of the file /goform/SetIpMacBind. This manipCVE-2026-287109.8Sensitive information disclosure and manipulation due to improper authentication. The following products are affected: Acronis Cyber ProtectCVE-2026-287116.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) beforCVE-2026-287126.3Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 17 (Windows) beforCVE-2026-287137.1Default credentials set for local privileged user in Virtual Appliance. The following products are affected: Acronis Cyber Protect Cloud AgeCVE-2026-287144.8Unnecessary transmission of sensitive cryptographic material. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows)CVE-2026-287156.5Sensitive information disclosure due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 (Linux,CVE-2026-287164.4Information disclosure and manipulation due to improper authorization checks. The following products are affected: Acronis Cyber Protect 17 CVE-2026-287175.0Local privilege escalation due to improper directory permissions. The following products are affected: Acronis Cyber Protect 17 (Windows) beCVE-2026-287187.5Denial of service due to insufficient input validation in authentication logging. The following products are affected: Acronis Cyber Protect