-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe GitHub pull request #5631 explicitly modifies these three functions in routers/repo/editor.go by adding path sanitization via cleanUploadFileName. The vulnerability stems from improper validation of user-controlled TreePath parameters in file operations, which allowed path traversal attacks. The functions were directly implicated in the security fix, and their pre-patch behavior matches the described vulnerability mechanism (arbitrary file deletion/edit via malformed paths).
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| code.gitea.io/gitea | go | <= 1.6.2 | 1.6.3 |