CVE-2026-28705 affects Gitea Open Source Git Server versions before 1.25.5. The vulnerability arises from the use of release tag names and asset names as filesystem path components without proper sanitization or limitation when dumping release assets. This can allow an attacker to craft names that manipulate the dump output paths, potentially leading to unauthorized file writes or path traversal effects. The CVSS score of 5.3 reflects a network attack vector with low complexity and no privileges or user interaction required, impacting confidentiality but not integrity or availability. No vendor advisory or patch information is currently available to confirm remediation status.

An attacker can supply specially crafted release tag or asset names that influence filesystem paths during asset dumping. This may lead to unauthorized disclosure of information or limited confidentiality impact by affecting where files are written. There is no indication of integrity or availability impact. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using untrusted or unvalidated release tag and asset names. Monitor Gitea vendor communications for updates and apply patches promptly once available.