← All advisories

High severityOSV Advisory· Published Dec 26, 2025· Updated Dec 26, 2025

CVE-2025-68939

CVE-2025-68939

Description

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
code.gitea.io/giteaGo	>= 0	—

Affected products

5

Go Gitea/GiteaOSV
Range: v0.9.99, v1.0.0, v1.1.0, …
osv-coords4 versions
pkg:apk/chainguard/gitea-fips pkg:bitnami/gitea pkg:golang/code.gitea.io/gitea pkg:rpm/opensuse/govulncheck-vulndb&distro=openSUSE%20Leap%2015.6
< 1.23.0-r0+ 3 more
- (no CPE)range: < 1.23.0-r0
- (no CPE)range: < 1.23.0
- (no CPE)range: >= 0
- (no CPE)range: < 0.0.20251230T014957-150000.1.134.1

Patches

Vulnerability mechanics

References

6

github.com/advisories/GHSA-263q-5cv3-xq9gghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2025-68939ghsaADVISORY
blog.gitea.com/release-of-1.23.0ghsaWEB
github.com/go-gitea/gitea/pull/32151ghsaWEB
github.com/go-gitea/gitea/releases/tag/v1.23.0ghsaWEB
blog.gitea.com/release-of-1.23.0/mitre

News mentions

0

No linked articles in our index yet.