GO-2026-6337
- Source
- https://pkg.go.dev/vuln/GO-2026-6337
- Import Source
- https://vuln.go.dev/ID/GO-2026-6337.json
- JSON Data
- https://api.osv.dev/v1/vulns/GO-2026-6337
- Aliases
- Published
- 2026-09-02T18:37:32Z
- Modified
- 2026-09-02T19:45:12.629349281Z
- Summary
- Gitea release asset dumps permit path traversal through crafted names in code.gitea.io/gitea
- Details
-
Gitea release asset dumps permit path traversal through crafted names in code.gitea.io/gitea
- Database specific
{ "url": "https://pkg.go.dev/vuln/GO-2026-6337", "review_status": "UNREVIEWED" }- References
-
- https://github.com/advisories/GHSA-7jvx-g65v-r899
- https://nvd.nist.gov/vuln/detail/CVE-2026-28705
- https://blog.gitea.com/release-of-1.25.5
- https://github.com/go-gitea/gitea/commit/833304ac15bce17d0f03c4852af5f60c186f6a70
- https://github.com/go-gitea/gitea/commit/f7ac5076711af3a260f3f98b2c1f8c19b32f6d09
- https://github.com/go-gitea/gitea/pull/36799
- https://github.com/go-gitea/gitea/pull/36839
- https://github.com/go-gitea/gitea/releases/tag/v1.25.5
Affected packages
Go / code.gitea.io/gitea
Package
- Name
- code.gitea.io/gitea
- View open source insights on deps.dev
- Purl
- pkg:golang/code.gitea.io/gitea