PT-2025-53436 · Gitea+1 · Gitea+1

Published 2025-12-26 · Updated 2026-02-24 · CVE-2025-68939

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.23.0

Description A flaw exists that enables attackers to add attachments with file extensions that are normally prohibited. This is achieved by modifying the attachment name through the attachment API. The affected API endpoint is the attachment API. Attackers manipulate the filename parameter to bypass file extension restrictions.

Recommendations Update to version 1.23.0 or later.

Fix

Weakness Enumeration

CWE-424

Related Identifiers

BIT-GITEA-2025-68939

CVE-2025-68939

GHSA-263Q-5CV3-XQ9G

GO-2025-4261

SUSE-SU-2026:0037-1

Affected Products

Gitea

Red Os

References · 92

• https://github.com/go-gitea/gitea/pull/32151 · Patch
• https://osv.dev/vulnerability/GO-2025-4261 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-68939 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-68939 · Vendor Advisory
• https://github.com/go-gitea/gitea/releases/tag/v1.23.0 · Note
• https://suse.com/security/cve/CVE-2025-68941 · Note
• https://suse.com/security/cve/CVE-2025-67508 · Note
• https://suse.com/security/cve/CVE-2025-10543 · Note
• https://suse.com/security/cve/CVE-2025-60633 · Note
• https://suse.com/security/cve/CVE-2025-68939 · Note
• https://suse.com/security/cve/CVE-2025-65637 · Note
• https://suse.com/security/cve/CVE-2025-66508 · Note
• https://suse.com/security/cve/CVE-2025-64702 · Note
• https://suse.com/security/cve/CVE-2025-64708 · Note