CVE-2026-49248

UNKNOWN 0.0

OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, TarUtils.untar() creates symbolic links verbatim from TAR entry getLinkName() without validating whether the target is an absolute path. A subsequent file entry in the same archive traverses the symlink, writing to arbitrary server-side locations. This is exploitable by any authenticated user with CI Job write access — no admin interaction required. This is an incomplete fix bypass of CVE-2021-21251 (GHSA-2w6j-wc8c-9mq2): that patch blocked .. path segments but did not address absolute symlink targets. This issue has been fixed in version 15.0.7.

CWE	CWE-61
Vendor	theonedev
Product	onedev
Published	Jun 18, 2026

Stay Ahead of the Next One

Get instant alerts for theonedev onedev

Be the first to know when new unknown vulnerabilities affecting theonedev onedev are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

theonedev / onedev

< 15.0.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/theonedev/onedev/security/advisories/GHSA-55g8-94r5-cj37 github.com: https://github.com/theonedev/onedev/commit/4f8684acebc4bfeefd3c7e23a34a4fd591cb27ad