CVE-2026-25718: Gitea template repository generation mishandles symlinked paths
Published Jul 3, 2026
·Updated
Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.
Affected Software
1 affected component
Gitea Gitea<1.25.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
giteato a version that resolves this vulnerability.Fixed in 1.25.5
Event History
Jul 3, 2026
CVE Published
via MITRE·08:19 PM
Data Sourced
via MITRE·08:19 PM
DescriptionWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-25718?
CVE-2026-25718 has a risk score of 51, indicating a moderate severity vulnerability.
2
How do I fix CVE-2026-25718?
To fix CVE-2026-25718, upgrade Gitea to version 1.25.5 or later.
3
What versions of Gitea are affected by CVE-2026-25718?
CVE-2026-25718 affects all Gitea versions before 1.25.5.
4
What type of vulnerability is CVE-2026-25718?
CVE-2026-25718 is a path traversal vulnerability that affects template repository generation.
5
What can attackers do with CVE-2026-25718?
Attackers can exploit CVE-2026-25718 to read or write to symlinked paths during template processing.