[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"repo-stars":3,"vuln-CVE-2026-25718":6},{"stargazers_count":4,"fetched_at":5},8,"2026-09-19T11:35:27.363Z",{"id":7,"descriptions":8,"cisa":9,"weaknesses":10,"exploits":195,"aliases":196,"duplicate_of":9,"upstream":199,"downstream":200,"duplicates":203,"related":204,"reserved_at":9,"published_at":206,"modified_at":207,"state":208,"summary":209,"references_raw":218,"kevs":266,"epss":267,"epss_history":270,"metrics":503,"affected":513},"CVE-2026-25718","Gitea versions before 1.25.5 mishandle path resolution during template repository generation, allowing template processing to read or write through symlinked or otherwise non-regular paths.",null,[11],{"_key":12,"id":12,"name":13,"description":14,"type":15,"status":16,"abstraction":17,"likelihood_of_exploit":18,"capec":19},"CWE-59","Improper Link Resolution Before File Access ('Link Following')","The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.","weakness","Draft","Base","Medium",[20,101,162,191],{"id":21,"name":22,"techniques":23},"CAPEC-132","Symlink Attack",[24],{"id":25,"name":26,"tactics":27,"countermeasures":34},"T1547.009","Shortcut Modification",[28,31],{"id":29,"name":30},"TA0110","Persistence",{"id":32,"name":33},"TA0111","Privilege Escalation",[35,40,45,49,53,57,62,67,71,75,80,84,88,92,96],{"id":36,"name":37,"tactic":38},"D3-LFP","Local File Permissions",{"name":39},"Isolate",{"id":41,"name":42,"tactic":43},"D3-DA","Dynamic Analysis",{"name":44},"Detect",{"id":46,"name":47,"tactic":48},"D3-FIM","File Integrity Monitoring",{"name":44},{"id":50,"name":51,"tactic":52},"D3-EFA","Emulated File Analysis",{"name":44},{"id":54,"name":55,"tactic":56},"D3-CM","Content Modification",{"name":39},{"id":58,"name":59,"tactic":60},"D3-FEV","File Eviction",{"name":61},"Evict",{"id":63,"name":64,"tactic":65},"D3-DF","Decoy File",{"name":66},"Deceive",{"id":68,"name":69,"tactic":70},"D3-FA","File Analysis",{"name":44},{"id":72,"name":73,"tactic":74},"D3-CF","Content Filtering",{"name":39},{"id":76,"name":77,"tactic":78},"D3-FE","File Encryption",{"name":79},"Harden",{"id":81,"name":82,"tactic":83},"D3-EAL","Executable Allowlisting",{"name":39},{"id":85,"name":86,"tactic":87},"D3-EDL","Executable Denylisting",{"name":39},{"id":89,"name":90,"tactic":91},"D3-RFAM","Remote File Access Mediation",{"name":39},{"id":93,"name":94,"tactic":95},"D3-CQ","Content Quarantine",{"name":39},{"id":97,"name":98,"tactic":99},"D3-RF","Restore File",{"name":100},"Restore",{"id":102,"name":103,"techniques":104},"CAPEC-17","Using Malicious Files",[105,142],{"id":106,"name":107,"tactics":108,"countermeasures":120},"T1574.005","Executable Installer File Permissions Weakness",[109,110,111,114,117],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},"TA0030","Defense Evasion",{"id":115,"name":116},"TA0005","Stealth",{"id":118,"name":119},"TA0104","Execution",[121,125,129,134,138],{"id":122,"name":123,"tactic":124},"D3-SU","Software Update",{"name":79},{"id":126,"name":127,"tactic":128},"D3-RS","Restore Software",{"name":100},{"id":130,"name":131,"tactic":132},"D3-AVE","Asset Vulnerability Enumeration",{"name":133},"Model",{"id":135,"name":136,"tactic":137},"D3-SWI","Software Inventory",{"name":133},{"id":139,"name":140,"tactic":141},"D3-SBV","Service Binary Verification",{"name":44},{"id":143,"name":144,"tactics":145,"countermeasures":151},"T1574.010","Services File Permissions Weakness",[146,147,148,149,150],{"id":29,"name":30},{"id":32,"name":33},{"id":112,"name":113},{"id":115,"name":116},{"id":118,"name":119},[152,154,156,158,160],{"id":126,"name":127,"tactic":153},{"name":100},{"id":135,"name":136,"tactic":155},{"name":133},{"id":139,"name":140,"tactic":157},{"name":44},{"id":130,"name":131,"tactic":159},{"name":133},{"id":122,"name":123,"tactic":161},{"name":79},{"id":163,"name":164,"techniques":165},"CAPEC-35","Leverage Executable Code in Non-Executable Files",[166,173,180],{"id":167,"name":168,"tactics":169,"countermeasures":172},"T1027.006","HTML Smuggling",[170,171],{"id":112,"name":113},{"id":115,"name":116},[],{"id":174,"name":175,"tactics":176,"countermeasures":179},"T1027.009","Embedded Payloads",[177,178],{"id":112,"name":113},{"id":115,"name":116},[],{"id":181,"name":182,"tactics":183,"countermeasures":186},"T1564.009","Resource Forking",[184,185],{"id":112,"name":113},{"id":115,"name":116},[187],{"id":188,"name":189,"tactic":190},"D3-FFV","File Format Verification",{"name":39},{"id":192,"name":193,"techniques":194},"CAPEC-76","Manipulating Web Input to File System Calls",[],[],[197,198],"GHSA-h697-89cp-24q8","GO-2026-6340",[],[201],{"_key":202},"OPENSUSE-SU-2026:21812-1",[],[205],{"_key":202},"2026-07-03T20:19:33.104Z","2026-07-07T16:59:46.910Z","Deferred",{"cisa_kev":210,"cisa_ransomware":210,"cisa_vendor":9,"epss_severity":211,"epss_score":212,"severity":213,"severity_score":214,"severity_version":215,"severity_source":216,"severity_vector":217,"severity_status":208},false,"low",0.00562,"critical",9.1,"v3.1","cve.org","CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",[219,227,231,236,240,245,249,253,257,262],{"url":220,"sources":221,"tags":224},"https://github.com/go-gitea/gitea/pull/36734",[216,222,223],"nvd","osv_go",[225,226],"Patch","WEB",{"url":228,"sources":229,"tags":230},"https://github.com/go-gitea/gitea/pull/36746",[216,222,223],[225,226],{"url":232,"sources":233,"tags":234},"https://github.com/go-gitea/gitea/releases/tag/v1.25.5",[216,222,223],[235,226],"Release Notes",{"url":237,"sources":238,"tags":239},"https://blog.gitea.com/release-of-1.25.5/",[216,222],[235],{"url":241,"sources":242,"tags":243},"https://nvd.nist.gov/vuln/detail/CVE-2026-25718",[223],[244],"Advisory",{"url":246,"sources":247,"tags":248},"https://github.com/go-gitea/gitea/commit/2176e84ab977011ff2bc3f3a9066020cc674f6b1",[223],[226],{"url":250,"sources":251,"tags":252},"https://github.com/go-gitea/gitea/commit/579615936c1ef7ba16c8887b9d12ade4c44f78fa",[223],[226],{"url":254,"sources":255,"tags":256},"https://blog.gitea.com/release-of-1.25.5",[223],[226],{"url":258,"sources":259,"tags":260},"https://github.com/go-gitea/gitea",[223],[261],"PACKAGE",{"url":263,"sources":264,"tags":265},"https://github.com/advisories/GHSA-h697-89cp-24q8",[223],[244],[],{"date":268,"score":212,"percentile":269},"2026-09-19",0.45572,[271,275,278,280,283,287,290,293,296,299,302,305,308,311,314,317,320,323,326,329,332,335,338,341,344,347,350,353,356,359,362,365,368,371,373,376,379,382,385,388,391,394,397,400,403,406,409,412,415,418,421,424,427,430,433,436,439,442,445,448,451,454,457,460,463,466,469,472,475,478,481,484,487,490,493,496,499,502],{"date":272,"score":273,"percentile":274},"2026-07-04",0.00172,0.06879,{"date":276,"score":273,"percentile":277},"2026-07-05",0.06876,{"date":279,"score":273,"percentile":274},"2026-07-06",{"date":281,"score":273,"percentile":282},"2026-07-07",0.06857,{"date":284,"score":285,"percentile":286},"2026-07-08",0.00428,0.34455,{"date":288,"score":285,"percentile":289},"2026-07-09",0.34505,{"date":291,"score":285,"percentile":292},"2026-07-10",0.3453,{"date":294,"score":285,"percentile":295},"2026-07-11",0.34565,{"date":297,"score":285,"percentile":298},"2026-07-12",0.34555,{"date":300,"score":285,"percentile":301},"2026-07-13",0.34571,{"date":303,"score":285,"percentile":304},"2026-07-14",0.34591,{"date":306,"score":285,"percentile":307},"2026-07-15",0.34667,{"date":309,"score":285,"percentile":310},"2026-07-16",0.34701,{"date":312,"score":285,"percentile":313},"2026-07-17",0.34703,{"date":315,"score":285,"percentile":316},"2026-07-18",0.34712,{"date":318,"score":285,"percentile":319},"2026-07-19",0.34714,{"date":321,"score":285,"percentile":322},"2026-07-20",0.34786,{"date":324,"score":285,"percentile":325},"2026-07-21",0.34797,{"date":327,"score":285,"percentile":328},"2026-07-22",0.34981,{"date":330,"score":285,"percentile":331},"2026-07-23",0.3499,{"date":333,"score":285,"percentile":334},"2026-07-24",0.35007,{"date":336,"score":285,"percentile":337},"2026-07-25",0.35084,{"date":339,"score":285,"percentile":340},"2026-07-26",0.35081,{"date":342,"score":285,"percentile":343},"2026-07-27",0.35058,{"date":345,"score":285,"percentile":346},"2026-07-28",0.35115,{"date":348,"score":285,"percentile":349},"2026-07-29",0.35131,{"date":351,"score":285,"percentile":352},"2026-07-30",0.35203,{"date":354,"score":285,"percentile":355},"2026-07-31",0.3523,{"date":357,"score":285,"percentile":358},"2026-08-01",0.35238,{"date":360,"score":285,"percentile":361},"2026-08-02",0.35242,{"date":363,"score":285,"percentile":364},"2026-08-03",0.35254,{"date":366,"score":285,"percentile":367},"2026-08-04",0.35227,{"date":369,"score":285,"percentile":370},"2026-08-05",0.35198,{"date":372,"score":285,"percentile":367},"2026-08-06",{"date":374,"score":285,"percentile":375},"2026-08-07",0.35275,{"date":377,"score":285,"percentile":378},"2026-08-08",0.35283,{"date":380,"score":285,"percentile":381},"2026-08-09",0.35266,{"date":383,"score":285,"percentile":384},"2026-08-10",0.35277,{"date":386,"score":285,"percentile":387},"2026-08-11",0.35368,{"date":389,"score":285,"percentile":390},"2026-08-12",0.35457,{"date":392,"score":285,"percentile":393},"2026-08-13",0.35495,{"date":395,"score":285,"percentile":396},"2026-08-14",0.35553,{"date":398,"score":285,"percentile":399},"2026-08-15",0.35689,{"date":401,"score":285,"percentile":402},"2026-08-16",0.35719,{"date":404,"score":285,"percentile":405},"2026-08-17",0.35663,{"date":407,"score":285,"percentile":408},"2026-08-18",0.35687,{"date":410,"score":285,"percentile":411},"2026-08-19",0.35872,{"date":413,"score":285,"percentile":414},"2026-08-20",0.35936,{"date":416,"score":285,"percentile":417},"2026-08-21",0.35982,{"date":419,"score":285,"percentile":420},"2026-08-22",0.35995,{"date":422,"score":285,"percentile":423},"2026-08-23",0.359,{"date":425,"score":212,"percentile":426},"2026-08-24",0.44215,{"date":428,"score":212,"percentile":429},"2026-08-25",0.44253,{"date":431,"score":212,"percentile":432},"2026-08-26",0.44343,{"date":434,"score":212,"percentile":435},"2026-08-27",0.444,{"date":437,"score":212,"percentile":438},"2026-08-28",0.4423,{"date":440,"score":212,"percentile":441},"2026-08-29",0.4427,{"date":443,"score":212,"percentile":444},"2026-08-30",0.44502,{"date":446,"score":212,"percentile":447},"2026-08-31",0.4451,{"date":449,"score":212,"percentile":450},"2026-09-01",0.44544,{"date":452,"score":212,"percentile":453},"2026-09-02",0.44592,{"date":455,"score":212,"percentile":456},"2026-09-03",0.44617,{"date":458,"score":212,"percentile":459},"2026-09-04",0.44657,{"date":461,"score":212,"percentile":462},"2026-09-05",0.44488,{"date":464,"score":212,"percentile":465},"2026-09-06",0.44726,{"date":467,"score":212,"percentile":468},"2026-09-07",0.44737,{"date":470,"score":212,"percentile":471},"2026-09-08",0.4476,{"date":473,"score":212,"percentile":474},"2026-09-09",0.44919,{"date":476,"score":212,"percentile":477},"2026-09-10",0.44945,{"date":479,"score":212,"percentile":480},"2026-09-11",0.44979,{"date":482,"score":212,"percentile":483},"2026-09-12",0.45059,{"date":485,"score":212,"percentile":486},"2026-09-13",0.45037,{"date":488,"score":212,"percentile":489},"2026-09-14",0.45065,{"date":491,"score":212,"percentile":492},"2026-09-15",0.45146,{"date":494,"score":212,"percentile":495},"2026-09-16",0.45332,{"date":497,"score":212,"percentile":498},"2026-09-17",0.4541,{"date":500,"score":212,"percentile":501},"2026-09-18",0.45548,{"date":268,"score":212,"percentile":269},[504,509,511],{"source":216,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":505,"cvss_v4_0":9},{"baseScore":214,"baseSeverity":506,"vectorString":217,"impactScore":507,"exploitabilityScore":508},"CRITICAL",8.7,10,{"source":222,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":510,"cvss_v4_0":9},{"baseScore":214,"baseSeverity":506,"vectorString":217,"impactScore":507,"exploitabilityScore":508},{"source":223,"cvss_v2_0":9,"cvss_v3_0":9,"cvss_v3_1":512,"cvss_v4_0":9},{"baseScore":214,"baseSeverity":9,"vectorString":217,"impactScore":507,"exploitabilityScore":508},[514,525],{"ecosystem":9,"name":515,"vendor":516,"product":517,"cpe_part":518,"purl_type":9,"purl_namespace":9,"purl_name":9,"source":9,"versions":519},"Gitea Open Source Git Server","gitea","gitea open source git server","a",[520],{"version":521,"is_range":522,"range_type":216,"version_start":9,"version_start_type":9,"version_end":523,"version_end_type":524,"fixed_in":9},"\u003C 1.25.5",true,"1.25.5","excluding",{"ecosystem":526,"name":527,"vendor":528,"product":516,"cpe_part":9,"purl_type":529,"purl_namespace":528,"purl_name":516,"source":9,"versions":530},"Go","code.gitea.io/gitea","code.gitea.io","golang",[531],{"version":532,"is_range":522,"range_type":533,"version_start":9,"version_start_type":9,"version_end":523,"version_end_type":524,"fixed_in":9},"lt1_25_5","semver"]