CVE-2022-39208

Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be read by unauthenticated users. This directory contains all projects, including their bare git repos and build artifacts. This file disclosure vulnerability can be used by unauthenticated attackers to leak all project files of any project. Since project IDs are incremental, an attacker could iterate through them and leak all project data. This issue has been resolved in version 7.3.0 and users are advised to upgrade. There are no known workarounds for this issue.

• CWE-552

• https://blog.sonarsource.com/onedev-remote-code-execution/Exploit, Third Party Advisory
• https://github.com/theonedev/onedev/commit/8aa94e0daf8447cdf76d4f27bfda0a85a7ea5822Patch, Third Party Advisory
• https://github.com/theonedev/onedev/security/advisories/GHSA-h427-rv56-c9h2Third Party Advisory
• https://blog.sonarsource.com/onedev-remote-code-execution/Exploit, Third Party Advisory
• https://github.com/theonedev/onedev/commit/8aa94e0daf8447cdf76d4f27bfda0a85a7ea5822Patch, Third Party Advisory
• https://github.com/theonedev/onedev/security/advisories/GHSA-h427-rv56-c9h2Third Party Advisory

Published

Sep 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-39201Grafana is an open source observability and data visualizati…7.5
• CVE-2022-39202matrix-appservice-irc is an open source Node.js IRC bridge f…6.3
• CVE-2022-39203matrix-appservice-irc is an open source Node.js IRC bridge f…8.8
• CVE-2022-39205Onedev is an open source, self-hosted Git Server with CI/CD …9.8
• CVE-2022-39206Onedev is an open source, self-hosted Git Server with CI/CD …9.9
• CVE-2022-39207Onedev is an open source, self-hosted Git Server with CI/CD …5.4
• CVE-2022-39209cmark-gfm is GitHub's fork of cmark, a CommonMark parsing an…6.5
• CVE-2022-3921The Listingo WordPress theme before 3.2.7 does not validate …9.8
• CVE-2022-39210Nextcloud android is the official Android client for the Nex…5.5
• CVE-2022-39211Nextcloud server is an open source personal cloud platform. …5.3
• CVE-2022-39212Nextcloud Talk is an open source chat, video & audio calls c…5.3
• CVE-2022-39213go-cvss is a Go module to manipulate Common Vulnerability Sc…7.5