CVE-2026-28705

CVE-2026-28705 affects Gitea before 1.25.5, where dump of release assets uses release tag names and asset names as filesystem path components. This allows a crafted tag or asset name to influence dump output paths, enabling a directory traversal-like issue (path traversal) that can impact how fil...