Live › vulnerability › CVE-2025-68939
Gitea before 1.23.0 lets an attacker rename an attachment through the attachment API so it carries a file extension the server normally forbids. The sources do not say what an attacker can do with such a file once it is stored.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:25 UTC, 0h before NVD. All times on this page are UTC.
Teams that self-host Gitea versions before 1.23.0 and allow users to create or edit attachments. The sources do not describe further conditions, so the exact exposure is unknown.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| code.gitea.io/gitea | go | < 1.23.0-rc0 | 1.23.0-rc0 |
| gitea | vendor | < 1.23.0 | 1.23.0 |
gitea --version or the server's admin dashboard.1.23.0-rc0 or later is installed.1.23.0-rc0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
This page as .md · .json · in your agent: get_signal("CVE-2025-68939")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.