CVE-2025-68939

HIGH

Gitea allows attackers to add attachments with forbidden file extensions

Title source: GitHub Advisory
STIX 2.1 vulnerability

Record summary

CVE-2025-68939 has a selected CVSS score of 8.2 (high).

Description

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Dec 26, 2025 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

Gitea

Browse Gitea / Gitea

Default status: unaffected

CVE ListBefore 1.23.0affected

code.gitea.io/gitea

Browse Go / code.gitea.io/gitea
GitHub AdvisoryAll versionsaffected

References

5