What’s Vulnerable › Products
theonedev onedev vulnerabilities
24 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.
Check whether your theonedev onedev version is affected
Latest theonedev onedev vulnerabilities
- CVE-2026-49248 — OneDev: RCE through absolute-path symlink following allows low-privileged users to overwrite arbitrary server via TarUtils.untar (CVSS 8.3)
- CVE-2026-11441 — theonedev Pull Request issues canAccessIssue improper authorization (CVSS 6.3)
- CVE-2026-11440 — theonedev REST API default-branch improper authorization (CVSS 6.3)
- CVE-2026-11439 — theonedev Parent Project projects improper authorization (CVSS 6.3)
- CVE-2026-11438 — theonedev projects improper authorization (CVSS 6.3)
- CVE-2026-44647 — OneDev: Path Traversal (read capability via Git LFS pointer resolution) (CVSS 7.1)
- CVE-2024-45309 — OneDev vulnerable to arbitrary file reading for unauthenticated user (CVSS 7.5)
- CVE-2023-24828 — Use of Cryptographically Weak Pseudo-Random Number Generator in Onedev (CVSS 8.8)
- CVE-2022-38301 — (CVSS 8.8)
- CVE-2022-39208 — Git Repository Disclosure in Onedev (CVSS 7.5)
- CVE-2022-39207 — Persistent XSS in OneDev (CVSS 5.4)
- CVE-2022-39206 — CI/CD Docker Escape in OneDev (CVSS 9.9)
- CVE-2022-39205 — Access Control Bypass in Onedev (CVSS 9.8)
- CVE-2021-32651 — LDAP injection via OneDev may leak some LDAP directory information (CVSS 4.3)
- CVE-2021-21251 — ZipSlip Arbitrary File Upload (CVSS 8.8)
- CVE-2021-21250 — Post-Auth External Entity Expansion (XXE) (CVSS 6.5)
- CVE-2021-21249 — Post-Auth Unsafe Yaml deserialization (CVSS 8.8)
- CVE-2021-21248 — Post-Auth Arbitrary Code execution via Groovy script injection (CVSS 8.8)
- CVE-2021-21247 — Post-Auth Unsafe Deserialization on BasePage (AJAX) (CVSS 8.8)
- CVE-2021-21246 — Pre-Auth Access token leak (CVSS 7.5)
- CVE-2021-21245 — Pre-Auth Arbitrary File Upload (CVSS 9.8)
- CVE-2021-21242 — Pre-Auth Unsafe Deserialization on AttachmentUploadServet (CVSS 9.8)
- CVE-2021-21244 — Pre-Auth SSTI via Bean validation message tampering (CVSS 9.8)
- CVE-2021-21243 — Pre-Auth Unsafe Deserialization on KubernetesResource (CVSS 9.8)