CVE-2026-25242

Katalog CVE

CVSS 9.8 · Critical EPSS 0,64%

Kerentanan Missing Authorization pada gogs. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1.

Rincian

Terbit di NVD

19 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-862: Missing Authorization

EPSS (30 hari)

0,64% peluang dieksploitasi; lebih tinggi dari 49,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36f exploit · patch · advisory vendor
• https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3 patch
• https://github.com/gogs/gogs/pull/8128 issue tracking
• https://github.com/gogs/gogs/releases/tag/v0.14.1 release notes