CVE-2026-49248

OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, TarUtils.untar() creates symbolic links verbatim from TAR entry getLinkName() without validating whether the target is an absolute path. A subsequent file entry in the same archive traverses the symlink, writing to arbitrary server-side locations. This is exploitable by any authenticated user with CI Job write access — no admin interaction required. This is an incomplete fix bypass of CVE-2021-21251 (GHSA-2w6j-wc8c-9mq2): that patch blocked .. path segments but did not address absolute symlink targets. This issue has been fixed in version 15.0.7.

• CWE-61

• https://github.com/theonedev/onedev/commit/4f8684acebc4bfeefd3c7e23a34a4fd591cb27ad
• https://github.com/theonedev/onedev/security/advisories/GHSA-55g8-94r5-cj37

Published

Jun 18, 2026

Last Modified

Jun 23, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-4924Improper authentication in the two-factor authentication (2…8.2
• CVE-2026-49241The Angular Language Service VS Code Extension provides a ri…8.8
• CVE-2026-49244SFTPGo is an open source, event-driven file transfer solutio…5.9
• CVE-2026-49245SFTPGo is an open source, event-driven file transfer solutio…3.7
• CVE-2026-49246Jellyfin is an open source self hosted media server. Prior t…1.7
• CVE-2026-49247Jellyfin is an open source self hosted media server. From 10…8.8
• CVE-2026-49249Boruta is a standalone authorization server that aims to imp…7.1
• CVE-2026-4925Improper access control in the users MFA feature in Devoluti…5
• CVE-2026-49250Conform, a type-safe form validation library, allows the par…8.7
• CVE-2026-49252deepstream is a server that allows clients and backend servi…9.9
• CVE-2026-49253electerm is an open-sourced terminal/ssh/sftp/telnet/serialp…7.1
• CVE-2026-49254Dragonfly is an open source P2P-based file distribution and …2.9