Theonedev vulnerabilities
We track 7 vulnerabilities in Theonedev products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on June 18, 2026.
Latest Theonedev vulnerabilities
- 8.3 High severity
onedev: UNIX Symbolic Link (Symlink) Following
OneDev is a Git server with CI/CD, kanban, and packages. In versions 15.0.6 and below, TarUtils.untar() creates symbolic links verbatim from TAR entry getLinkName() without validating whether the target is an absolute path. A subsequent file entry in the same
- 7.1 High severity
onedev: Improper Limitation of a Pathname to a Restricted Directory
OneDev is a Git server with CI/CD, kanban, and packages. Prior to 15.0.2, there is behavior that breaks the expected boundary between repository-controlled LFS metadata and server-local filesystem paths. A repository object can steer raw blob reads to arbitrar
- 7.5 High severity
onedev: Improper Limitation of a Pathname to a Restricted Directory
OneDev is a Git server with CI/CD, kanban, and packages. A vulnerability in versions prior to 11.0.9 allows unauthenticated users to read arbitrary files accessible by the OneDev server process. This issue has been fixed in version 11.0.9.
- 8.8 High severity
onedev: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Onedev is a self-hosted Git Server with CI/CD and Kanban. In versions prior to 7.9.12 the algorithm used to generate access token and password reset keys was not cryptographically secure. Existing normal users (or everyone if it allows self-registration) may e
- 7.5 High severity
onedev: Files or Directories Accessible to External Parties
Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. All files in the /opt/onedev/sites/ directory are exposed and can be read by unauthenticated users. This directory contains all projects, including their bare git repos and build artifacts
- 9.9 Critical severity
onedev: Externally Controlled Reference to a Resource in Another Sphere
Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. When using Docker-based job executors, the Docker socket (e.g. /var/run/docker.sock on Linux) is mounted into each Docker step. Users that can define and trigger CI/CD jobs on a project co
- 9.8 Critical severity
onedev: Improper Authentication
Onedev is an open source, self-hosted Git Server with CI/CD and Kanban. In versions of Onedev prior to 7.3.0 unauthenticated users can take over a OneDev instance if there is no properly configured reverse proxy. The /git-prereceive-callback endpoint is used b