CVE-2026-44647

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-44647
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44647.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-44647
Aliases
  • GHSA-59wq-74xg-w85v
Published
2026-05-14T20:08:10.326Z
Modified
2026-07-15T01:48:52.629211292Z
Severity
  • 7.1 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
OneDev: Path Traversal (read capability via Git LFS pointer resolution)
Details

OneDev is a Git server with CI/CD, kanban, and packages. Prior to 15.0.2, there is behavior that breaks the expected boundary between repository-controlled LFS metadata and server-local filesystem paths. A repository object can steer raw blob reads to arbitrary local files that the server account can access. User with push permission to any repository will be able to access any server files accessible by server process. This vulnerability is fixed in 15.0.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44647.json"
}
References

Affected packages

Git / github.com/theonedev/onedev

Affected ranges

Type
GIT
Repo
https://github.com/theonedev/onedev
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
0c8db6b391bf87201ab9e0a237492804a24a02cd
Database specific 
{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "15.0.2"
        }
    ]
}

Affected versions

2.*
2.0-beta-build119
2.0-beta-build120
2.0.0
2.0.4
2.0.5
v10.*
v10.0.0
v10.1.0
v10.1.1
v10.1.2
v10.1.3
v10.1.4
v10.1.5
v10.2.0
v10.2.1
v10.3.0
v10.3.1
v10.3.2
v10.3.3
v10.4.0
v10.5.1
v10.5.2
v10.6.0
v10.7.0
v10.7.1
v10.7.2
v10.7.3
v10.7.5
v10.7.6
v10.7.7
v10.8.0
v10.9.0
v10.9.1
v10.9.2
v10.9.3
v10.9.4
v10.9.5
v10.9.6
v11.*
v11.0.0
v11.0.1
v11.0.2
v11.0.6
v11.0.7
v11.0.8
v11.0.9
v11.1.0
v11.1.1
v11.1.2
v11.1.3
v11.1.6
v11.10.0
v11.10.1
v11.10.2
v11.10.3
v11.10.4
v11.11.0
v11.11.1
v11.2.0
v11.2.1
v11.3.0
v11.3.1
v11.3.2
v11.4.0
v11.4.1
v11.5.0
v11.5.1
v11.6.0
v11.6.1
v11.6.10
v11.6.11
v11.6.12
v11.6.13
v11.6.14
v11.6.15
v11.6.16
v11.6.2
v11.6.3
v11.6.4
v11.6.5
v11.6.6
v11.6.7
v11.6.8
v11.6.9
v11.7.0
v11.7.1
v11.7.2
v11.7.3
v11.7.4
v11.7.6
v11.8.0
v11.8.1
v11.8.2
v11.8.3
v11.8.4
v11.8.5
v11.8.6
v11.8.7
v11.9.1
v11.9.2
v11.9.3
v11.9.4
v11.9.5
v11.9.6
v11.9.7
v11.9.8
v11.9.9
v12.*
v12.0.0
v12.0.1
v12.0.10
v12.0.2
v12.0.3
v12.0.4
v12.0.5
v12.0.6
v12.0.7
v12.0.8
v12.0.9
v13.*
v13.0.0
v13.0.1
v13.0.10
v13.0.2
v13.0.3
v13.0.4
v13.0.5
v13.0.6
v13.0.7
v13.0.8
v13.0.9
v13.1.0
v13.1.3
v13.1.4
v13.1.6
v13.1.7
v14.*
v14.0.0
v14.0.1
v14.0.2
v14.0.3
v14.0.4
v14.0.5
v14.0.6
v14.0.7
v14.0.8
v14.1.0
v14.1.1
v14.1.2
v14.1.3
v14.1.4
v14.1.5
v14.1.6
v14.1.7
v15.*
v15.0.0
v15.0.1
v3.*
v3.0.10
v3.0.4
v3.0.5
v3.0.6
v3.0.7
v3.0.8
v3.0.9
v3.1.0
v3.1.1
v3.1.2
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.2.4
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4
v4.0.5
v4.0.6
v4.0.7
v4.0.8
v4.0.9
v4.1.0
v4.1.2
v4.1.3
v4.1.4
v4.1.5
v4.1.6
v4.10.3
v4.11.0
v4.2.0
v4.2.1
v4.2.2
v4.2.3
v4.2.4
v4.2.5
v4.3.0
v4.3.2
v4.4.0
v4.4.1
v4.4.2
v4.4.3
v4.6.0
v4.6.1
v4.7.0
v4.8.0
v4.8.1
v4.9.0
v4.9.1
v4.9.2
v5.*
v5.0.0
v5.0.1
v5.1.0
v5.2.0
v5.2.1
v5.2.2
v5.3.0
v5.3.1
v5.3.3
v5.4.0
v6.*
v6.0.0
v6.1.0
v6.1.1
v6.1.2
v6.1.3
v6.1.4
v6.2.0
v6.2.1
v6.2.2
v6.2.3
v6.2.4
v6.3.0
v6.3.1
v6.3.10
v6.3.11
v6.3.12
v6.3.13
v6.3.2
v6.3.3
v6.3.4
v6.3.5
v6.3.6
v6.3.7
v6.3.8
v6.3.9
v7.*
v7.0.0
v7.0.1
v7.0.2
v7.0.3
v7.1.0
v7.1.1
v7.1.2
v7.1.3
v7.1.6
v7.1.7
v7.1.8
v7.2.0
v7.2.1
v7.2.2
v7.2.3
v7.2.4
v7.2.5
v7.2.7
v7.2.8
v7.2.9
v7.3.0
v7.3.10
v7.3.11
v7.3.12
v7.3.13
v7.3.14
v7.3.15
v7.3.2
v7.3.3
v7.3.4
v7.3.5
v7.3.6
v7.3.7
v7.3.8
v7.3.9
v7.4.0
v7.4.1
v7.4.10
v7.4.11
v7.4.12
v7.4.13
v7.4.14
v7.4.15
v7.4.16
v7.4.17
v7.4.18
v7.4.19
v7.4.2
v7.4.20
v7.4.21
v7.4.22
v7.4.23
v7.4.24
v7.4.25
v7.4.26
v7.4.27
v7.4.28
v7.4.29
v7.4.3
v7.4.7
v7.4.8
v7.4.9
v7.5.0
v7.5.1
v7.5.2
v7.5.3
v7.6.0
v7.6.1
v7.6.2
v7.7.1
v7.7.12
v7.7.13
v7.7.14
v7.7.2
v7.7.5
v7.8.0
v7.8.1
v7.8.10
v7.8.11
v7.8.12
v7.8.13
v7.8.14
v7.8.15
v7.8.2
v7.8.3
v7.8.4
v7.8.5
v7.8.6
v7.8.7
v7.8.8
v7.8.9
v7.9.0
v7.9.1
v7.9.2
v7.9.3
v7.9.4
v7.9.5
v7.9.6
v7.9.7
v8.*
v8.0.0
v8.0.1
v8.0.10
v8.0.11
v8.0.12
v8.0.13
v8.0.14
v8.0.15
v8.0.2
v8.0.3
v8.0.4
v8.0.5
v8.0.6
v8.0.7
v8.0.8
v8.0.9
v8.1.0
v8.1.1
v8.1.2
v8.1.3
v8.1.4
v8.1.5
v8.1.6
v8.2.0
v8.2.1
v8.2.2
v8.2.3
v8.2.4
v8.2.5
v8.2.7
v8.2.8
v8.3.0
v8.3.1
v8.3.2
v8.3.3
v8.3.4
v8.3.5
v8.3.6
v8.3.7
v8.3.8
v8.4.0
v8.4.1
v8.4.2
v8.5.0
v8.5.1
v8.5.2
v8.5.3
v8.5.4
v8.5.5
v8.5.6
v8.5.7
v8.5.8
v8.5.9
v8.6.0
v8.6.1
v8.6.10
v8.6.11
v8.6.12
v8.6.2
v8.6.4
v8.6.5
v8.6.6
v8.6.7
v8.6.8
v8.6.9
vv11.*
vv11.7.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44647.json"