CVE-2026-25242

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25242", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-30T14:44:47.329Z", "datePublished": "2026-02-19T02:28:40.140Z", "dateUpdated": "2026-02-19T17:44:40.834Z"}, "containers": {"cna": {"title": "Gogs allows unauthenticated file uploads", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36f", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36f"}, {"name": "https://github.com/gogs/gogs/pull/8128", "tags": ["x_refsource_MISC"], "url": "https://github.com/gogs/gogs/pull/8128"}, {"name": "https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3", "tags": ["x_refsource_MISC"], "url": "https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3"}, {"name": "https://github.com/gogs/gogs/releases/tag/v0.14.1", "tags": ["x_refsource_MISC"], "url": "https://github.com/gogs/gogs/releases/tag/v0.14.1"}], "affected": [{"vendor": "gogs", "product": "gogs", "versions": [{"version": "< 0.14.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T02:28:40.140Z"}, "descriptions": [{"lang": "en", "value": "Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1."}], "source": {"advisory": "GHSA-fc3h-92p8-h36f", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T17:23:29.408186Z", "id": "CVE-2026-25242", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:44:40.834Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25242", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T17:23:29.408186Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T17:23:31.009Z"}}], "cna": {"title": "Gogs allows unauthenticated file uploads", "source": {"advisory": "GHSA-fc3h-92p8-h36f", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "gogs", "product": "gogs", "versions": [{"status": "affected", "version": "< 0.14.1"}]}], "references": [{"url": "https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36f", "name": "https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36f", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/gogs/gogs/pull/8128", "name": "https://github.com/gogs/gogs/pull/8128", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3", "name": "https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/gogs/gogs/releases/tag/v0.14.1", "name": "https://github.com/gogs/gogs/releases/tag/v0.14.1", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-19T02:28:40.140Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25242", "state": "PUBLISHED", "dateUpdated": "2026-02-19T17:44:40.834Z", "dateReserved": "2026-01-30T14:44:47.329Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-19T02:28:40.140Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gogs", "vendor": "gogs", "versions": [{"status": "affected", "version": "< 0.14.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*", "matchCriteriaId": "44DD72D9-ED94-407D-8C71-6C2B039C65BB", "versionEndExcluding": "0.14.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1."}, {"lang": "es", "value": "Gogs es un servicio Git autoalojado de c\u00f3digo abierto. Las versiones 0.13.4 e inferiores exponen endpoints de carga de archivos no autenticados por defecto. Cuando la configuraci\u00f3n global RequireSigninView est\u00e1 deshabilitada (por defecto), cualquier usuario remoto puede cargar archivos arbitrarios al servidor a trav\u00e9s de /releases/attachments y /issues/attachments. Esto permite que la instancia sea utilizada indebidamente como un host de archivos p\u00fablico, lo que podr\u00eda llevar al agotamiento del disco, al alojamiento de contenido o a la entrega de malware. Los tokens CSRF no mitigan este ataque debido a la emisi\u00f3n de cookies del mismo origen. Este problema ha sido solucionado en la versi\u00f3n 0.14.1."}], "id": "CVE-2026-25242", "lastModified": "2026-06-17T10:24:21.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-25242", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-19T17:23:29.408186Z", "version": "2.0.3"}}]}, "published": "2026-02-19T07:17:45.687", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3"}, {"source": "security-advisories@github.com", "tags": ["Issue Tracking"], "url": "https://github.com/gogs/gogs/pull/8128"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/gogs/gogs/releases/tag/v0.14.1"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Patch", "Vendor Advisory"], "url": "https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36f"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.14.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "gogs", "source": "cna", "vendor": "gogs"}, "product": "gogs", "vendor": "gogs"}], "analysis": {"en": {"generated_at": "2026-04-17T18:18:04.539672+00:00", "value": {"mitigation_remediation": ["Upgrade Gogs to version 0.14.1 or later, where the unauthenticated upload feature has been removed.", "If an immediate upgrade is not possible, modify the Gogs configuration to enable RequireSigninView or otherwise lock down the /releases/attachments and /issues/attachments endpoints so that only authenticated users can upload files.", "Configure firewall or reverse\u2011proxy rules to block unauthenticated requests to the /releases/attachments and /issues/attachments paths."], "summary": {"action": "Patch Now", "impact": "Unauthorized file upload leading to potential malware hosting or disk exhaustion"}, "threat_synthesis": {"affected_systems": "The vulnerable versions are Gogs releases 0.13.4 and older. The product is available under the gogs gogs CPE. These versions are listed by the CNA as affected and have not been patched until the 0.14.1 release, which removes the unauthenticated upload capability.", "description_and_impact": "Gogs, an open\u2011source self\u2011hosted Git platform, contains a flaw that allows anyone on the Internet to upload arbitrary files to certain directory endpoints. When the server\u2019s RequireSigninView option is left disabled\u2014the default setting\u2014remote users can target /releases/attachments and /issues/attachments without authentication. The flaw provides a means for hostile actors to upload malicious payloads or large amounts of data, which can be used to host malware, exhaust disk space, or otherwise influence the instance\u2019s integrity and availability. The issue is rooted in an access\u2011control weakness (CWE\u2011862), and it bypasses CSRF protection because the cookie is issued under the same origin.", "risk_and_exploitability": "The CVSS base score of 6.9 indicates a moderate\u2011to\u2011high risk. The EPSS score is below 1\u202f%, suggesting a low probability of exploitation, and the vulnerability is not currently in the CISA KEV catalog. Because the attack requires only an unauthenticated HTTP request to a publicly accessible endpoint, it can be carried out by anyone with network access to the instance. Attackers could then upload files that the service stores or serves to other users. While malicious execution is not guaranteed by the vulnerability alone, the presence of uploaded code creates a vector for subsequent compromise or denial\u2011of\u2011service."}}}}, "created": "2026-02-19T10:07:49.849444+00:00", "updated": "2026-04-17T18:30:05.646014+00:00", "vendors": ["gogs", "gogs$PRODUCT$gogs"]}