CVE-2025-68939
published 2025-12-26CVE-2025-68939: Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
PriorityP430medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.34%
26.2th percentile
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
| gitea | gitea | < 1.23.0 | 1.23.0 |
| gitea | gitea_open_source_git_server | <= 1.26.4 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
ghsa5.3MEDIUM
vendor_redhat8.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
code.gitea.io/gitea: Gitea: Attachment allowlist bypass via web release edit form
vendor_redhat·2026-08-13·CVSS 5.3
CVE-2026-58428 [MEDIUM] CWE-434 code.gitea.io/gitea: Gitea: Attachment allowlist bypass via web release edit form
code.gitea.io/gitea: Gitea: Attachment allowlist bypass via web release edit form
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
A flaw was found in Gitea. An authenticated remote attacker with repository write permission could bypass the attachment extension allowlist via the web release edit form. This vulnerability allows the attacker to rename existing release attachments to forbidden file extensions, potentially leading to the distribution of malicious files or stored Cross-Site Scripting (XSS) attacks.
Statement: The vulnerability, a Moderate attachment allowlist bypass in Gitea, allows an authenticated attacker to upload files with forbidden extensions by manipulating the web release edit form. However, Red Hat products are not
Red Hat
gitea: attachments can be renamed to forbidden file extensions via the attachment API
vendor_redhat·2025-12-26·CVSS 8.2
CVE-2025-68939 [HIGH] CWE-424 gitea: attachments can be renamed to forbidden file extensions via the attachment API
gitea: attachments can be renamed to forbidden file extensions via the attachment API
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
A flaw was found in Gitea. An attacker can exploit this issue by editing an attachment name via the attachment API, allowing attachments with forbidden file extensions to be added, bypassing security controls and potentially resulting in unauthorized data modification or execution of malicious content.
Statement: While this issue allows a forbidden file to exist in the server, it does not automatically execute it. An attack depends on how the underlying server is configured, such as the availability of script interpreters or directories with execute permissions, li
GHSA
Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
ghsa·2026-07-21·CVSS 5.3
CVE-2026-58428 [MEDIUM] CWE-424 Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
## Summary
The web handler `EditReleasePost` (`routers/web/repo/release.go`) reads form fields with prefix `attachment-edit-{uuid}` into a `map[uuid]newName`, passes that map to `release_service.UpdateRelease`, which writes the new name to the database via `repo_model.UpdateAttachmentByUUID` WITHOUT calling `upload.Verify` against `setting.Repository.Release.AllowedTypes`. The parent CVE-2025-68939 fix (PR #32151) added the equivalent `upload.Verify` call on the API edit endpoints via `attachment_service.UpdateAttachment`. The web release edit path was not updated.
A user with repository write permission can rename any existing release attachment to a name with a forbidden extensio
OSV
Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea
osv·2025-12-30
CVE-2025-68939 Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea
Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea
Gitea allows attackers to add attachments with forbidden file extensions in code.gitea.io/gitea
GHSA
Gitea allows attackers to add attachments with forbidden file extensions
ghsa·2025-12-26
CVE-2025-68939 [HIGH] CWE-424 Gitea allows attackers to add attachments with forbidden file extensions
Gitea allows attackers to add attachments with forbidden file extensions
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
OSV
Gitea allows attackers to add attachments with forbidden file extensions
osv·2025-12-26
CVE-2025-68939 [HIGH] Gitea allows attackers to add attachments with forbidden file extensions
Gitea allows attackers to add attachments with forbidden file extensions
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58428 code.gitea.io/gitea: Gitea: Attachment allowlist bypass via web release edit form
bugzilla·2026-08-13·CVSS 5.3
CVE-2026-58428 [MEDIUM] CVE-2026-58428 code.gitea.io/gitea: Gitea: Attachment allowlist bypass via web release edit form
CVE-2026-58428 code.gitea.io/gitea: Gitea: Attachment allowlist bypass via web release edit form
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
Wiz
CVE-2025-68939 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 8.2
CVE-2025-68939 [HIGH] CVE-2025-68939 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2025-68939 :
NixOS vulnerability analysis and mitigation
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
Source : NVD
## 5.3
Score
Published December 26, 2025
Severity MEDIUM
CNA Score 8.2
Affected Technologies
NixOS
Gitea
Has Public Exploit No
Has CISA KEV Exploit No
CISA KEV Release Date N/A
CISA KEV Due Date N/A
Exploitation Probability Percentile (EPSS) 2.2
Exploitation Probability (EPSS) N/A
Affected packages and libraries
gitea
cpe:2.3:a:gitea:gitea
Sources
Alpine 3.10, 3.11, 3.12, 3.13, 3.14, 3.15, 3.16, 3.17, 3.18, 3.19, 3.20, 3.21 Severity MEDIUM No Fix Added at: Jan 03, 2026
Chainguard Has Fix Added at: Dec 28, 2025
GoLang Severity HIGH Has Fix Added at: De
2025-12-26
Published