CVE-2026-25921

Published: Mar 5, 2026Modified: Jun 17, 2026

9.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L

Exploitability: 3.9 / Impact: 4.7

Source: security-advisories@github.com (Secondary)

Description

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2.

Affected (1)

Products: Gogs: Gogs

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Gogs Gogs	Before 0.14.2

Related CWEs

Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

References (4)

https://github.com/gogs/gogs/commit/81ee8836445ac888d99da8b652be7d5cbc5c4d5c

Source: security-advisories@github.com

Patch

https://github.com/gogs/gogs/pull/8166

Source: security-advisories@github.com

Issue Tracking

https://github.com/gogs/gogs/releases/tag/v0.14.2

Source: security-advisories@github.com

Release Notes

https://github.com/gogs/gogs/security/advisories/GHSA-cj4v-437j-jq4c

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

Timeline

No history available yet.