CVE-2026-44647

HighCVSS 7.1/10Last modified Oct 26, 2026

Description

OneDev is a Git server with CI/CD, kanban, and packages. Prior to 15.0.2, there is behavior that breaks the expected boundary between repository-controlled LFS metadata and server-local filesystem paths. A repository object can steer raw blob reads to arbitrary local files that the server account can access. User with push permission to any repository will be able to access any server files accessible by server process. This vulnerability is fixed in 15.0.2.

Metrics

CVSS 4.0 7.1/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
theonedev	onedev	< 15.0.2

References

https://github.com/theonedev/onedev/security/advisories/GHSA-59wq-74xg-w85v

Timeline

Published: May 14, 2026
Last modified: Oct 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-446487.5SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-446499.8SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-44658.8A flaw has been found in D-Link DIR-513 1.10. The impacted element is an unknown function of the file /goform/formSysCmd. Executing a manipu CVE-2026-446509.1SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-446516.9SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-446526.9SillyTavern is a locally installed user interface that allows users to interact with text generation large language models, image generation CVE-2026-446536.5LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, users with only `VIEW` ac CVE-2026-446548.1LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, a shared-agent editor can CVE-2026-446558.6Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 1.3.0 to 2.28.1, unescaped Project Name allows an attacker that can set CVE-2026-446565.3Vim is an open source, command line text editor. Prior to version 9.2.0435, an OS command injection vulnerability exists in Vim's :find comm CVE-2026-446577.5Mantis Bug Tracker (MantisBT) is an open source issue tracker. Prior to 2.28.2, using show_inline=1 parameter and a valid file_show_inline_t CVE-2026-446582.4Zen is a firefox-based browser. Prior to 1.19.12b, RSS feed URLs entered by the user are validated to http: or https: in promptForFeedUrl, b