CVE-2025-68939High· 8.2▾ TwilightGitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
0.3% → 0.4%
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
gitea < 1.23.0Upgrade past the affected range:
gitea 1.23.0Affected packages:
code.gitea.io/giteaConnected by shared product, vendor, weakness, or advisory.
CVE-2026-34966High· 7.6Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default …
CVE-2026-73802Critical· 9.9Gitea Runner passes workflow-controlled container options into Docker job container configuration while privileged mode is disabled
CVE-2026-60004Critical· 9.8Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
CVE-2026-58428Medium· 6.5Gitea: Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939)
CVE-2025-69413Medium· 5.3In Gitea before 1.25.2, /api/v1/user has different responses for failed authentication depending on whether a username exists.
CVE-2026-73539High· 7.5Gitea substitutes a URL derived from the markup Context field into external renderer command templates without escaping the reference path before shell-style argument splitting