Executive brief
OneDev, an integrated Git server and CI/CD platform, contains a security flaw that allows users with repository access to read sensitive files from the server's local storage. By manipulating Git Large File Storage (LFS) metadata, an authorized user can bypass security boundaries to access any file the server process has permission to read. This could lead to the exposure of configuration files, credentials, or other sensitive data hosted on the server.
Technical details
A path traversal vulnerability (CWE-22) exists in OneDev's Git LFS pointer resolution mechanism. The root cause is an improper limitation of repository-controlled LFS metadata, which allows a repository object to steer raw blob reads to arbitrary local filesystem paths. An attacker with push permissions to any repository can craft malicious LFS metadata to read arbitrary files accessible by the server process. This vulnerability is exploited over the network and requires low-level authentication (push access). The issue is resolved in version 15.0.2.
Affected products
- OneDev OneDev < 15.0.2
Timeline
- 2026-05-03: advisory: GitHub advisory published by vendor
- 2026-05-14: disclosed: CVE published to NVD
- 2026-05-14: patched: Fix confirmed in version 15.0.2