Quick answers
- Is CVE-2026-44647 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-44647 being exploited in the wild.
- How severe is CVE-2026-44647?
- Informational severity, with a CVSS score of 7.1, published 14 May 2026.
- Which products and versions are affected?
- OneDev < 15.0.2.
- Is there a fix for CVE-2026-44647?
- A patch was published on 2026-05-14: Fix confirmed in version 15.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-44647 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-44647?
- Check whether you run OneDev at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A path traversal vulnerability (CWE-22) exists in OneDev's Git LFS pointer resolution mechanism. The root cause is an improper limitation of repository-controlled LFS metadata, which allows a repository object to steer raw blob reads to arbitrary local filesystem paths. An attacker with push permissions to any repository can craft malicious LFS metadata to read arbitrary files accessible by the server process. This vulnerability is exploited over the network and requires low-level authentication (push access). The issue is resolved in version 15.0.2.
Affected products
- OneDev OneDev < 15.0.2
Timeline
- 2026-05-03: advisory: GitHub advisory published by vendor
- 2026-05-14: disclosed: CVE published to NVD
- 2026-05-14: patched: Fix confirmed in version 15.0.2