File Extension Manipulation Vulnerability in Gitea by Gitea Team
CVE-2025-68939

8.2HIGH

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
26 December 2025

What is CVE-2025-68939?

A vulnerability in Gitea prior to version 1.23.0 allows attackers to exploit the attachment API by modifying the names of uploaded attachments. This exploitation enables the inclusion of files with disallowed extensions, potentially leading to significant security risks such as execution of malicious code and unauthorized access.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Gitea 0 < 1.23.0

References

https://blog.gitea.com/release-of-1.23.0/
https://github.com/go-gitea/gitea/releases/tag/v1.23.0
https://github.com/go-gitea/gitea/pull/32151

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.