CVE-2025-68939 - OpenCVE

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Gitea	Gitea

No data.

No data.

References

Link	Providers
https://blog.gitea.com/release-of-1.23.0/
https://github.com/go-gitea/gitea/pull/32151
https://github.com/go-gitea/gitea/releases/tag/v1.23.0
https://nvd.nist.gov/vuln/detail/CVE-2025-68939
https://www.cve.org/CVERecord?id=CVE-2025-68939

History

Sat, 27 Dec 2025 00:15:00 +0000

Type	Values Removed	Values Added
Title		gitea: attachments can be renamed to forbidden file extensions via the attachment API
References		https://nvd.nist.gov/vuln/detail/CVE-2025-68939 https://www.cve.org/CVERecord?id=CVE-2025-68939
Metrics	threat_severity `None`	threat_severity `Important`

Fri, 26 Dec 2025 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Fri, 26 Dec 2025 02:45:00 +0000

Type	Values Removed	Values Added
Description		Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
First Time appeared		Gitea Gitea gitea
Weaknesses		CWE-424
CPEs		cpe:2.3:a:gitea:gitea::::::::
Vendors & Products		Gitea Gitea gitea
References		https://blog.gitea.com/release-of-1.23.0/ https://github.com/go-gitea/gitea/pull/32151 https://github.com/go-gitea/gitea/releases/tag/v1.23.0
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2025-12-26T02:03:59.691Z

Updated: 2025-12-26T18:57:27.065Z

Reserved: 2025-12-26T02:03:59.388Z

Link: CVE-2025-68939

Vulnrichment

Updated: 2025-12-26T14:40:07.617Z

NVD

Status : Received

Published: 2025-12-26T03:15:50.653

Modified: 2025-12-26T03:15:50.653

Link: CVE-2025-68939

Redhat

Severity : Important

Publid Date: 2025-12-26T02:03:59Z

Links: CVE-2025-68939 - Bugzilla

{"dataType": "CVE_RECORD", "cveMetadata": {"cveId": "CVE-2025-68939", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "state": "PUBLISHED", "assignerShortName": "mitre", "dateReserved": "2025-12-26T02:03:59.388Z", "datePublished": "2025-12-26T02:03:59.691Z", "dateUpdated": "2025-12-26T18:57:27.065Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "packageURL": "pkg:golang/code.gitea.io/gitea", "product": "Gitea", "vendor": "Gitea", "versions": [{"lessThan": "1.23.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*", "versionEndExcluding": "1.23.0"}]}]}], "descriptions": [{"lang": "en", "value": "Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-424", "description": "CWE-424 Improper Protection of Alternate Path", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-12-26T18:57:27.065Z"}, "references": [{"url": "https://blog.gitea.com/release-of-1.23.0/"}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.23.0"}, {"url": "https://github.com/go-gitea/gitea/pull/32151"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-26T14:40:06.574200Z", "id": "CVE-2025-68939", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-26T14:51:01.455Z"}}]}, "dataVersion": "5.2"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-68939", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-26T14:40:06.574200Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-26T14:40:07.617Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Gitea", "product": "Gitea", "versions": [{"status": "affected", "version": "0", "lessThan": "1.23.0", "versionType": "semver"}], "packageURL": "pkg:golang/code.gitea.io/gitea", "defaultStatus": "unaffected"}], "references": [{"url": "https://blog.gitea.com/release-of-1.23.0/"}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v1.23.0"}, {"url": "https://github.com/go-gitea/gitea/pull/32151"}], "x_generator": {"engine": "CVE-Request-form 0.0.1"}, "descriptions": [{"lang": "en", "value": "Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-424", "description": "CWE-424 Improper Protection of Alternate Path"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "1.23.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2025-12-26T18:57:27.065Z"}}}, "cveMetadata": {"cveId": "CVE-2025-68939", "state": "PUBLISHED", "dateUpdated": "2025-12-26T18:57:27.065Z", "dateReserved": "2025-12-26T02:03:59.388Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2025-12-26T02:03:59.691Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"bugzilla": {"description": "gitea: attachments can be renamed to forbidden file extensions via the attachment API", "id": "2425460", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2425460"}, "csaw": false, "cvss3": {"cvss3_base_score": "8.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L", "status": "draft"}, "cwe": "CWE-424", "details": ["A flaw was found in Gitea. An attacker can exploit this issue by editing an attachment name via the attachment API, allowing attachments with forbidden file extensions to be added, bypassing security controls and potentially resulting in unauthorized data modification or execution of malicious content."], "mitigation": {"lang": "en:us", "value": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible."}, "name": "CVE-2025-68939", "package_state": [{"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-cli-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-cli-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-controller-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-watcher-rhel9", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel8", "product_name": "OpenShift Pipelines"}, {"cpe": "cpe:/a:redhat:openshift_pipelines:1", "fix_state": "Affected", "package_name": "openshift-pipelines/pipelines-pipelines-as-code-webhook-rhel9", "product_name": "OpenShift Pipelines"}], "public_date": "2025-12-26T02:03:59Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-68939\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-68939\nhttps://blog.gitea.com/release-of-1.23.0/\nhttps://github.com/go-gitea/gitea/pull/32151\nhttps://github.com/go-gitea/gitea/releases/tag/v1.23.0"], "statement": "While this issue allows a forbidden file to exist in the server, it does not automatically execute it. An attack depends on how the underlying server is configured, such as the availability of script interpreters or directories with execute permissions, limiting the likelihood of a successful exploitation. Additionally, an attacker must convince a user to click, download or open the renamed attachment, limiting the impact of this issue. Due to these reasons, this flaw has been rated with an important severity.", "threat_severity": "Important"}