Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2025-68939 · Microsoft / collected KEV context

EUVD-2025-205411

GHSA-263q-5cv3-xq9g

BIT-gitea-2025-68939

GO-2025-4261

cve-program · CVE-2025-68939

• https://blog.gitea.com/release-of-1.23.0/
• https://github.com/go-gitea/gitea/releases/tag/v1.23.0
• https://github.com/go-gitea/gitea/pull/32151

euvd · EUVD-2025-205411

• https://blog.gitea.com/release-of-1.23.0/
• https://github.com/go-gitea/gitea/releases/tag/v1.23.0
• https://github.com/go-gitea/gitea/pull/32151

nvd · CVE-2025-68939

• https://blog.gitea.com/release-of-1.23.0/
• https://github.com/go-gitea/gitea/pull/32151
• https://github.com/go-gitea/gitea/releases/tag/v1.23.0

osv · GHSA-263q-5cv3-xq9g

• https://nvd.nist.gov/vuln/detail/CVE-2025-68939
• https://github.com/go-gitea/gitea/pull/32151
• https://github.com/go-gitea/gitea/commit/7adc4717ec8e4f8fe678010866e936cf024f498d
• https://blog.gitea.com/release-of-1.23.0
• https://github.com/go-gitea/gitea
• https://github.com/go-gitea/gitea/releases/tag/v1.23.0

osv · GO-2025-4261

• https://github.com/advisories/GHSA-263q-5cv3-xq9g
• https://nvd.nist.gov/vuln/detail/CVE-2025-68939
• https://blog.gitea.com/release-of-1.23.0
• https://github.com/go-gitea/gitea/pull/32151
• https://github.com/go-gitea/gitea/releases/tag/v1.23.0

• Gitea allows attackers to add attachments with forbidden file extensions · Source adds a fixed version · 3 Nov 2026