Gitea versions before 1.25.5 improperly handle path resolution when generating template repositories. This improper link resolution ('link following') vulnerability enables attackers to cause the template processing to read or write files through symbolic links or other non-regular paths. This can result in unauthorized access or modification of files outside the intended scope. The vulnerability is remotely exploitable without authentication and does not require user interaction, making it highly critical.

Successful exploitation can lead to high confidentiality and integrity impacts by allowing unauthorized reading or writing of files via symlink traversal during template repository generation. There is no impact on availability reported. The vulnerability can be exploited remotely without privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid using template repository generation features with untrusted input or in untrusted environments to reduce risk.