Skip to contentTheonedev Onedev vulnerabilities
- theonedev onedevOneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untarCVE-2026-492488.3 High
- theonedev onedevtheonedev Pull Request issues canAccessIssue improper authorizationCVE-2026-114415.3 Medium
- theonedev onedevtheonedev REST API default-branch improper authorizationCVE-2026-114405.3 Medium
- theonedev onedevtheonedev Parent Project projects improper authorizationCVE-2026-114395.3 Medium
- theonedev onedevtheonedev projects improper authorizationCVE-2026-114385.3 Medium
- theonedev onedevOneDev: Path Traversal (read capability via Git LFS pointer resolution)CVE-2026-446477.1 High
- onedev project onedevOneDev vulnerable to arbitrary file reading for unauthenticated userCVE-2024-45309EPSS 24.5%8.7 High
- onedev project onedevUse of Cryptographically Weak Pseudo-Random Number Generator in OnedevCVE-2023-248288.1 High
- onedev project onedevCI/CD Docker Escape in OneDevCVE-2022-392069.9 Critical
- onedev project onedevPersistent XSS in OneDevCVE-2022-392075.4 Medium
- onedev project onedevGit Repository Disclosure in OnedevCVE-2022-392087.5 High
- onedev project onedevAccess Control Bypass in OnedevCVE-2022-392059.0 Critical
- onedev project onedevLDAP injection via OneDev may leak some LDAP directory informationCVE-2021-326513.1 Low
- onedev project onedevPre-Auth Arbitrary File UploadCVE-2021-2124510.0 Critical
- onedev project onedevPre-Auth Access token leakCVE-2021-21246EPSS 49.1%8.6 High
- onedev project onedevPost-Auth Unsafe Deserialization on BasePage (AJAX)CVE-2021-212479.6 Critical
- onedev project onedevPost-Auth Unsafe Yaml deserializationCVE-2021-212499.6 Critical
- onedev project onedevPost-Auth Arbitrary Code execution via Groovy script injectionCVE-2021-212489.6 Critical
- onedev project onedevPost-Auth External Entity Expansion (XXE)CVE-2021-212507.7 High
- onedev project onedevZipSlip Arbitrary File UploadCVE-2021-21251EPSS 12.7%7.7 High
- onedev project onedevPre-Auth Unsafe Deserialization on AttachmentUploadServetCVE-2021-21242EPSS 74.2%10.0 Critical
- onedev project onedevPre-Auth Unsafe Deserialization on KubernetesResourceCVE-2021-21243EPSS 54.5%10.0 Critical
- onedev project onedevPre-Auth SSTI via Bean validation message tamperingCVE-2021-2124410.0 Critical