high8.2
CVE-2025-68939
Gitea allows attackers to add attachments with forbidden file extensions
Impact
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| go | code.gitea.io/gitea | < 1.23.0 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gitea | Gitea | before 1.23.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://blog.gitea.com/release-of-1.23.0/
- https://github.com/go-gitea/gitea/pull/32151
- https://github.com/go-gitea/gitea/releases/tag/v1.23.0
- https://github.com/advisories/GHSA-263q-5cv3-xq9g
- https://nvd.nist.gov/vuln/detail/CVE-2025-68939
- https://blog.gitea.com/release-of-1.23.0