GHSA-263q-5cv3-xq9g
Gitea allows attackers to add attachments with forbidden file extensions
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Go | code.gitea.io/gitea | < 1.23.0-rc0 | 1.23.0-rc0 |
Details
As written in the advisory (Markdown source, shown as plain text).
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2025-68939
- https://github.com/go-gitea/gitea/pull/32151
- https://github.com/go-gitea/gitea/commit/7adc4717ec8e4f8fe678010866e936cf024f498d
- https://blog.gitea.com/release-of-1.23.0
- https://github.com/go-gitea/gitea
- https://github.com/go-gitea/gitea/releases/tag/v1.23.0