CVE-2026-25242

Name: CVE-2026-25242
Creator: NVD / NIST
Published: 2026-02-19T07:17:45.687+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.9/10EPSS 0.62%

Last modified Jun 17, 2026

CVE-2026-25242 is a medium-severity vulnerability rated 6.9/10 on the CVSS scale. Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. EPSS estimates a 0.62% chance of exploitation in the next 30 days.

Description

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS 4.0

6.9/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability

0.62%

45.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-862

Affected Software

Vendor	Product	Versions
Gogs	Gogs	< 0.14.1

References

https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3Patch
https://github.com/gogs/gogs/pull/8128Issue Tracking
https://github.com/gogs/gogs/releases/tag/v0.14.1Release Notes
https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36fExploit, Patch, Vendor Advisory

Timeline

Published: Feb 19, 2026
Last Modified: Jun 17, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2026-25242?

How severe is CVE-2026-25242?

CVE-2026-25242 has a CVSS score of 6.9/10 (MEDIUM severity). The EPSS model estimates a 0.62% probability of exploitation in the next 30 days.

How do I fix CVE-2026-25242?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2026-25242?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST