TI-2025-42395 Aliases CVE-2025-68939 GHSA-263q-5cv3-xq9g

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by…

LOW 38CWE-424Published 2025-12-26 · Updated 2025-12-26

Key facts

Attack vector: Network
Privileges required: None
User interaction: Required
Attack complexity: High
Impact type: —
Confidentiality · integrity · availability: High · High · Low
Fix status: Partial Red Hat: 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00332 26th percentileScored 2026-11-07

Fix Partial Gitea (Gitea): 1.23.0code.gitea.io/gitea (Go): 1.23.0-rc0Red Hat: 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Gitea	Gitea	before 1.23.0	1.23.0	Patch available	CNA
—	code.gitea.io/gitea (Go)	before 1.23.0-rc0	1.23.0-rc0	Patch available	GHSA-263q-5cv3-xq9g

Gitea VendorGitea Affected before 1.23.0 Fixed in 1.23.0 Patch available CNA
code.gitea.io/gitea (Go) Vendor— Affected before 1.23.0-rc0 Fixed in 1.23.0-rc0 Patch available GHSA-263q-5cv3-xq9g

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:gitea:gitea::::::-::*	before 1.23.0	Vulnerable	Gitea

cpe:2.3:a:gitea:gitea:*:*:*:*:*:-:*:* Versions before 1.23.0 Vulnerable ·Gitea

Remediation

Fix · CNA Gitea (Gitea) Fixed in 1.23.0
Fix · GHSA-263q-5cv3-xq9g code.gitea.io/gitea (Go) Fixed in 1.23.0-rc0 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Product	Status	Plan or fix
OpenShift Pipelines	Affected	No fix yet

Timeline

2026-10-02 Threatist record created from CVE-2025-68939
2026-10-03 Alias added: GHSA-263q-5cv3-xq9g
2026-11-03 Fix available: Go/code.gitea.io/[email protected] · GHSA-263q-5cv3-xq9g
2026-11-03 1 new reference · GHSA-263q-5cv3-xq9g

References

Patch 1

https://github.com/go-gitea/gitea/pull/32151

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-68939

Other 5

TI-2026-42785 Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. KEVCVSS 3.1CRITICAL 9.8
TI-2020-11072 The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote… CVSS 3.1HIGH 7.2
TI-2022-12910 Gitea before 1.16.7 does not escape git fetch remote. CVSS 3.1HIGH 7.5
TI-2019-08404 models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror… CVSS 3.1HIGH 8.8
TI-2022-00955 Open Redirect on login in go-gitea/gitea CVSS 3.1MEDIUM 6.1
TI-2026-68968 Push-to-create bypass of FORCE_PRIVATE policy in Gitea CVSS 3.1MEDIUM 5.4

See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences