Vulnerability details

CVE-2026-49248

theonedev onedev

OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar

CVSS 4.0

8.3High

Official description

OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, TarUtils.untar() creates symbolic links verbatim from TAR entry getLinkName() without validating whether the target is an absolute path. A subsequent file entry in the same archive traverses the symlink, writing to arbitrary server-side locations. This is exploitable by any authenticated user with CI Job write access — no admin interaction required. This is an incomplete fix bypass of CVE-2021-21251 (GHSA-2w6j-wc8c-9mq2): that patch blocked .. path segments but did not address absolute symlink targets. This issue has been fixed in version 15.0.7.

CVSS scores

Score	Version	Source	Vector
8.3High	4.0	CVEProject cvelistV5 (CNA) (GitHub_M)	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N`

Affected products

Vendor	Product	Versions	Source
theonedev	onedev	< 15.0.7	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/theonedev/onedev/security/advisories/GHSA-55g8-94r5-cj37 x_refsource_CONFIRM
https://github.com/theonedev/onedev/commit/4f8684acebc4bfeefd3c7e23a34a4fd591cb27ad x_refsource_MISC

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-06-18
Last updated: 2026-06-22
State: Published
Assigner (CNA): GitHub_M

Exploit prediction (EPSS)

0.57%

Probability of exploitation in 30 days

47.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: None
Technical impact: Partial

Weaknesses (CWE)

CWE-61
UNIX Symbolic Link (Symlink) Following