Vulnerability in Theonedev Onedev
CVE-2026-49248
OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, TarUtils.untar() creates symbolic links verbatim from TAR entry getLinkName() without validating whether the target is an absolute path. A subsequent fi…
EPSS: 0.006 (43.8th percentile) — read the EPSS interpretation.
Affected products
- Theonedev Onedev — versions < 15.0.7
Weakness classification (CWE)
References
- security-advisories@github.com (x_refsource_CONFIRM)
- security-advisories@github.com (x_refsource_MISC)