External risk intelligence

Gitea Template Repository Path Resolution Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-25718

Gitea is a self-hosted Git service commonly deployed as a web application accessible over the internet to facilitate remote code collaboration and repository management. Because these instances often serve as public-facing or external-facing developer portals, the vulnerable functionality within the repository generation process is plausibly reachable from the internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Gitea's template repository generation could allow an attacker to access or modify files outside of designated areas by manipulating path resolution. This could lead to unauthorized data exposure or alteration within affected systems. The main concern at this time is confirming relevance and exposure to our environment.

Improper file handling could expose sensitive data.
Limits access to sensitive information or systems.
Assess Gitea's use and potential impact.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by leveraging Gitea's template repository generation feature. By manipulating paths during this process, an attacker could trick the system into reading from or writing to unintended locations on the server, potentially leading to data compromise or modification.

Unauthenticated network access
Template repository generation
Sensitive file access and modification

Live Threat

Current exploitation, exposure, and threat context

The vulnerability in Gitea's template repository generation could allow an attacker to read or write to arbitrary file system locations through specially crafted template repositories. This could occur when new repositories are initialized using a malicious template, potentially impacting system files or user data.

System files or user data could be affected.
Malicious templates could be processed.
Unauthorized file access or modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Determine ownership by identifying Gitea deployment owners, likely within platform or application teams, and assess exposure to prioritize remediation. Begin by cataloging all Gitea instances, confirming their internet reachability and business criticality. Coordinate with accountable owners to plan for updates or mitigating controls, considering existing maintenance windows and vendor coordination.

Platform/Application teams own the issue.
Verify Gitea instance reachability and criticality.
Plan remediation based on verified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Gitea?

Gitea is an open-source, self-hosted Git service used for software development. It provides teams with a web-based interface to host, manage, and collaborate on code repositories, serving as a centralized platform for version control and project documentation.

What does CVE-2026-25718 mean?

This CVE describes a path traversal weakness, specifically categorized as CWE-59 (Improper Link Resolution Before File Access). It means the software fails to properly handle file paths when creating a repository from a template. Because of this, the system can be tricked into reading or writing files outside of the intended directory, potentially accessing sensitive system data.

How does the template generation vulnerability trigger?

The flaw is triggered when the system processes a repository created from a template. If a user utilizes a malicious template, the software may follow symbolic links or non-regular paths to access forbidden files. Simply viewing or browsing existing repositories without triggering the specific template generation process does not initiate this vulnerability.

Why should I be concerned about Gitea internet accessibility?

According to Halo Surface Signal, Gitea is frequently deployed as a public-facing developer portal. Since the vulnerable template generation process is accessible over a network, an instance exposed to the internet increases the likelihood that a remote attacker could reach this function and potentially compromise the underlying server's data.

Is an update required to fix this?

Yes. If you run Gitea, you should verify if your version is earlier than 1.25.5. Since this vulnerability allows unauthorized file read or write access, the primary response is to coordinate with your team to update to a patched version as soon as possible, while also assessing which instances are accessible via the network.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.