← Voltar para CVEs
CVE-2026-25242
CRITICAL9.8
Descricao
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1.
Detalhes CVE
Pontuacao CVSS v3.19.8
SeveridadeCRITICAL
Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vetor de ataqueNETWORK
ComplexidadeLOW
Privilegios necessariosNONE
Interacao do usuarioNONE
Publicado2/19/2026
Ultima modificacao2/19/2026
Fontenvd
Avistamentos honeypot0
Produtos afetados
gogs:gogs
Fraquezas (CWE)
CWE-862
Referencias
https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3(security-advisories@github.com)
https://github.com/gogs/gogs/pull/8128(security-advisories@github.com)
https://github.com/gogs/gogs/releases/tag/v0.14.1(security-advisories@github.com)
https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36f(security-advisories@github.com)
Correlacoes IOC
Sem correlacoes registradas
This product uses data from the NVD API but is not endorsed or certified by the NVD.