Vulnerability in Gogs Git Service Allows Malicious Overwriting of LFS Objects
CVE-2026-25921

9.3CRITICAL

Key Information:

Vendor: Gogs
Status: Gogs
Vendor: CVE Published:; 5 March 2026

What is CVE-2026-25921?

Gogs, an open-source self-hosted Git service, is susceptible to a critical flaw where LFS (Large File Storage) objects can be maliciously overwritten across different repositories. This vulnerability allows attackers to manipulate LFS objects, posing a significant risk of supply-chain attacks. The issue was addressed and patched in version 0.14.2, reinforcing the need for users to update their installations to protect against potential exploitation.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch