Home > Vulnerability Database > CVE-2025-68939

Mend.io Vulnerability Database

New vulnerability? Tell us about it!

CVE-2025-68939

Good to know:

Date: December 25, 2025

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

Severity Score

8.2

Related Resources (7)

Url: https://blog.gitea.com/release-of-1.23.0

Url: https://nvd.nist.gov/vuln/detail/CVE-2025-68939

Url: https://blog.gitea.com/release-of-1.23.0/

Url: https://github.com/go-gitea/gitea/pull/32151

Url: https://github.com/go-gitea/gitea/releases/tag/v1.23.0

Url: https://github.com/go-gitea/gitea

Url: https://www.mend.io/vulnerability-database/CVE-2025-68939

Severity Score

8.2

Weakness Type (CWE)

Improper Protection of Alternate Path

CWE-424

Top Fix

Upgrade Version

Upgrade to version https://github.com/go-gitea/gitea.git - v1.23.0

CVSS v3.1

Base Score:	8.2
Attack Vector (AV):	NETWORK
Attack Complexity (AC):	HIGH
Privileges Required (PR):	NONE
User Interaction (UI):	REQUIRED
Scope (S):	CHANGED
Confidentiality (C):	HIGH
Integrity (I):	HIGH
Availability (A):	LOW

Do you need more information?

Contact Us