CVE-2025-68939: High severity gitea vulnerability
Published Dec 26, 2025
·Updated
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
Affected Software
3 affected components
gitea<1.23.0
go/code.gitea.io/gitea<1.23.0
Gitea Gitea<1.23.0
Remediation
Patch Available
Event History
Dec 26, 2025
CVE Published
via MITRE·02:03 AM
Data Sourced
via MITRE·02:03 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·03:15 AM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·03:30 AM
Data Sourced
via GitHub·03:30 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-68939?
CVE-2025-68939 has been classified as a high severity vulnerability due to the ability for attackers to add malicious attachments.
2
How do I fix CVE-2025-68939?
To fix CVE-2025-68939, upgrade Gitea to version 1.23.0 or later to ensure the proper validation of attachment file extensions.
3
What versions of Gitea are affected by CVE-2025-68939?
CVE-2025-68939 affects all Gitea versions prior to 1.23.0.
4
What kind of attack does CVE-2025-68939 facilitate?
CVE-2025-68939 allows attackers to bypass file extension restrictions, potentially uploading harmful files.
5
Is user authentication impacted by CVE-2025-68939?
CVE-2025-68939 does not directly affect user authentication but allows for the potential upload of malicious files that could compromise user data.