CVE-2026-25718
published 2026-07-03CVE-2026-25718: Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked…
PriorityP350critical9.1CVSS 3.1
AVNACLPRNUINSUCHIHAN
EPSS
0.56%
45.6th percentile
Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.25.5 | 1.25.5 |
| gitea | gitea_open_source_git_server | < 1.25.5 | 1.25.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.
ghsa_unreviewed·2026-07-03
CVE-2026-25718 CWE-59 Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.
Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.
GHSA
Gitea template repository generation follows unsafe filesystem paths
ghsa·2026-07-03
CVE-2026-25718 [CRITICAL] CWE-59 Gitea template repository generation follows unsafe filesystem paths
Gitea template repository generation follows unsafe filesystem paths
Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-07-03
Published