CVE-2025-68939: Gitea allows attackers to add attachments with forbidden file extensions
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/code.gitea.io/giteato a version that resolves this vulnerability.Fixed in 1.23.0-rc0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-68939?
CVE-2025-68939 has been classified as a high severity vulnerability due to the ability for attackers to add malicious attachments.
How do I fix CVE-2025-68939?
To fix CVE-2025-68939, upgrade Gitea to version 1.23.0 or later to ensure the proper validation of attachment file extensions.
What versions of Gitea are affected by CVE-2025-68939?
CVE-2025-68939 affects all Gitea versions prior to 1.23.0.
What kind of attack does CVE-2025-68939 facilitate?
CVE-2025-68939 allows attackers to bypass file extension restrictions, potentially uploading harmful files.
Is user authentication impacted by CVE-2025-68939?
CVE-2025-68939 does not directly affect user authentication but allows for the potential upload of malicious files that could compromise user data.