CVE-2026-25242

MEDIUM EPSS 45.1%
Published Feb 19, 20264mo ago · Modified Jun 17, 20261w ago
6.9 CVSS 4.0
Medium
Find Similar
Published Feb 19, 2026 4mo ago
Last Modified Jun 17, 2026 1w ago

Description

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1.

CVSS Details

Base Score
6.9
Exploitability
—
Impact
—
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X

Threat Intelligence

EPSS Exploit Probability
45.1% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-862 Missing Authorization Authorization

Affected Products 1

VendorProductVersionRange
gogsgogs* <0.14.1

References 4

  • github.com https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3
    Patch
  • github.com https://github.com/gogs/gogs/pull/8128
    Issue Tracking
  • github.com https://github.com/gogs/gogs/releases/tag/v0.14.1
    Release Notes
  • github.com https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36f
    ExploitPatchVendor Advisory

Remediation

  • github.com https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3
    Patch
  • github.com https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36f
    ExploitPatchVendor Advisory