Vulnerability · Published Feb 19, 2026 · Assigned by GitHub_M

CVE-2026-25242Gogs allows unauthenticated file uploads

Medium 6.9

In plain English

A medium-severity missing authorization in gogs from gogs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.7%top 47.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	gogs.io/gogs	0.14.1	GHSA-fc3h-92p8-h36f
Go	gogs.io/gogs	no fix listed	GO-2026-4500

Affected products (as reported)

Vendor	Product	Versions
gogs	gogs	< 0.14.1

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

https://github.com/gogs/gogs/security/advisories/GHSA-fc3h-92p8-h36f x_refsource_CONFIRM
https://github.com/gogs/gogs/pull/8128 x_refsource_MISC
https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3 x_refsource_MISC
https://github.com/gogs/gogs/releases/tag/v0.14.1 x_refsource_MISC