{"id":"CVE-2025-68939","kind":"vulnerability","aliases":["CVE-2025-68939","GHSA-263q-5cv3-xq9g"],"related":[],"title":"Gitea allows attackers to add attachments with forbidden file extensions","description":"Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.","summary":"Gitea before 1.23.0 lets an attacker rename an attachment through the attachment API so it carries a file extension the server normally forbids. The sources do not say what an attacker can do with such a file once it is stored.","severity":"high","cvss":8.2,"epss":0.00332,"exploited":false,"exploited_at":null,"products":[{"name":"code.gitea.io/gitea","fixed":["1.23.0-rc0"],"affected":"< 1.23.0-rc0","ecosystem":"go"},{"name":"gitea","fixed":["1.23.0"],"affected":"< 1.23.0","ecosystem":"vendor"}],"ecosystems":["go","vendor"],"tags":["cwe-424","gitea","package","self-hosted"],"not_affected_if":["gitea-1.23.0-or-later"],"how_to_check":"- Check the running Gitea version with `gitea --version` or the server's admin dashboard.\n- Confirm whether `1.23.0-rc0` or later is installed.","fix":"- Gitea: `1.23.0-rc0`","status":"open","published_at":"2025-12-26T03:15:50+00:00","first_seen_at":"2026-11-03T16:25:28+00:00","triaged_at":"2026-11-03T16:25:41+00:00","updated_at":"2026-11-03T16:51:48+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-03T16:25:41Z","model":"claude-haiku-5-5","output":{"fix":"- Gitea: `1.23.0-rc0`","reach":"network","title":"Gitea: attachment API lets users upload forbidden file extensions","impact":"medium","summary":"Gitea before 1.23.0 lets an attacker rename an attachment through the attachment API so it carries a file extension the server normally forbids. The sources do not say what an attacker can do with such a file once it is stored.","audience":"businesses","category":"package","nicknames":[],"who_cares":["gitea","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"unknown: forbidden file types stored on the server","analyst_note":"","how_to_check":"- Check the running Gitea version with `gitea --version` or the server's admin dashboard.\n- Confirm whether `1.23.0-rc0` or later is installed.","plain_action":"","needs_analyst":false,"not_affected_if":["gitea-1.23.0-or-later"],"who_is_affected":"Teams that self-host Gitea versions before 1.23.0 and allow users to create or edit attachments. The sources do not describe further conditions, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000636,"input_tokens":4160,"output_tokens":440,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2025':12A,20A '-424':27B '-68939':13A,21A '/gitea':24A '1.23.0':35B,76C '263q':16A '5cv3':17A 'add':5A,80C 'allow':2A,77C 'api':45B,94C 'attach':6A,41B,44B,81C,89C,93C 'attack':3A,38B,63B,78C 'carri':48B 'code.gitea.io':23A 'code.gitea.io/gitea':22A 'cve':11A,19A 'cwe':26B 'edit':87C 'extens':10A,51B,85C 'file':9A,50B,69B,84C 'forbid':55B 'forbidden':8A,83C 'ghsa':15A 'ghsa-263q-5cv3-xq9g':14A 'gitea':1A,25A,28B,33B,74C 'host':32B 'let':36B 'name':90C 'normal':54B 'packag':29B 'renam':39B 'say':60B 'self':31B 'self-host':30B 'server':53B 'sourc':57B 'store':73B 'via':91C 'xq9g':18A","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Gitea versions before 1.23.0 and allow users to create or edit attachments. The sources do not describe further conditions, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["codegiteaiogitea","gitea"],"ptokens":["code","gitea","io"],"labels":["cwe424","gitea","go","high","package","selfhosted","vendor"],"first_public_at":"2025-12-26T03:15:50+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-263q-5cv3-xq9g","url":"https://github.com/advisories/GHSA-263q-5cv3-xq9g","severity":"high","published_at":"2025-12-26T03:30:15+00:00","modified_at":"2026-11-03T16:24:52+00:00","first_seen_at":"2026-11-03T16:25:28+00:00","fetched_at":"2026-11-03T16:30:30+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-68939","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-68939","severity":null,"published_at":"2025-12-26T03:15:50+00:00","modified_at":"2026-10-13T10:10:00+00:00","first_seen_at":"2026-11-03T16:51:48+00:00","fetched_at":"2026-11-03T16:51:48+00:00","note":null}],"documents":[{"id":58878,"url":"https://github.com/go-gitea/gitea/pull/32151","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":58879,"url":"https://github.com/go-gitea/gitea/releases/tag/v1.23.0","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":58880,"url":"https://github.com/go-gitea/gitea/commit/7adc4717ec8e4f8fe678010866e936cf024f498d","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":59068,"url":"https://blog.gitea.com/release-of-1.23.0/","title":"Release notes: blog.gitea.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: blog.gitea.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}