Gitea releases prior to 1.25.5 construct file paths for release assets by concatenating and the asset filename without sanitizing them. This design allows an attacker who can create a release to supply a maliciously named asset, causing the application to write files to directories outside the intended upload folder. Based on the description, it is inferred that such crafted names could result in arbitrary file writes on the host, potentially overwriting critical configuration files or creating privileged files, which constitutes a File and Directory Path Traversal weakness (CWE‑22).

All versions of the Gitea Open Source Git Server released before 1.25.5 are affected. Any deployment that permits users to create releases and attach assets—regardless of operating system, cloud platform, or hosting environment—is within risk scope.

The CVSS score of 5.3 indicates moderate impact, while the EPSS score of < 1% reflects a very low but not zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the information, it is inferred that an attacker must have authenticated permissions to publish releases; through the upload of a malicious asset name, they can trigger the path traversal and write arbitrary files on the host. The attack vector is therefore limited to those who can modify releases via the web interface or API.