← Zuruck zu CVEs
CVE-2026-25242
CRITICAL9.8
Beschreibung
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1.
CVE Details
CVSS v3.1 Bewertung9.8
SchweregradCRITICAL
CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AngriffsvektorNETWORK
KomplexitatLOW
Erforderliche PrivilegienNONE
BenutzerinteraktionNONE
Veroffentlicht2/19/2026
Zuletzt geandert2/19/2026
Quellenvd
Honeypot-Sichtungen0
Betroffene Produkte
gogs:gogs
Schwachen (CWE)
CWE-862
Referenzen
https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3(security-advisories@github.com)
https://github.com/gogs/gogs/pull/8128(security-advisories@github.com)
https://github.com/gogs/gogs/releases/tag/v0.14.1(security-advisories@github.com)
https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36f(security-advisories@github.com)
IOC Korrelationen
Keine Korrelationen erfasst
This product uses data from the NVD API but is not endorsed or certified by the NVD.