CVE Intelligence
Analysis AI-assisted

CVE-2026-25242: Gogs unauthenticated file upload via attachment endpoints

Gogs versions 0.13.4 and below expose file upload endpoints without authentication by default, which is classified as missing authorization (CWE-862). Any remote user can store arbitrary files on the server when the RequireSigninView setting is disabled, its default. The issue is fixed in 0.14.1, and the sources consulted do not show confirmed exploitation.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Gogs is a self-hosted Git service. According to the record, versions 0.13.4 and below expose unauthenticated file upload endpoints by default. The weakness is classified as missing authorization (CWE-862).

Impact

  • When the global RequireSigninView setting is disabled, which is its default, any remote user can upload arbitrary files through the release and issue attachment endpoints.
  • The instance could be abused as a public file host, with risks of disk exhaustion, content hosting, or delivery of malware.
  • According to the advisory, CSRF tokens do not mitigate this issue because of same-origin cookie issuance.
  • NVD scores the issue 9.8 (critical). GitHub scores it 6.9 under the newer CVSS standard.

Affected products and versions

  • Product: Gogs (Gogs Gogs).
  • Affected: versions before 0.14.1, which the record describes as 0.13.4 and below.
  • Fixed in: 0.14.1.

Exploitation status

This CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. The record includes an Exploit tag on the GitHub advisory reference, but that tag does not by itself establish exploitation in the wild.

Remediation and mitigation

  • Upgrade Gogs to 0.14.1 or later, which the record identifies as the fixed version.
  • Until the upgrade is complete, consider keeping RequireSigninView enabled so that uploads are limited to signed-in users (inference; confirm the behavior against the vendor advisory).
  • Consider restricting access to the attachment endpoints at a reverse proxy or network layer as a temporary measure (inference).
  • Review and enforce storage quotas and cleanup routines for attachment directories.

Detection guidance

  • Review web access logs for POST requests to the release and issue attachment endpoints, especially from unauthenticated sessions.
  • Monitor disk usage growth on the Gogs data volume for unexpected increases.
  • Inspect attachment storage for files unrelated to project activity or with unusual types.

Limitations of the available information

  • The sources do not state file size limits, allowed file types, or storage locations.
  • The record does not confirm whether enabling RequireSigninView fully closes both endpoints.
  • This analysis relies on the record and its references, not on a code review or a test of any instance.
  • The EPSS value is a statistical estimate and does not confirm exploitation.

Frequently asked questions

Is this Gogs vulnerability being actively exploited?

This CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted. Defenders should still patch promptly because the flaw is easy to reach when the default setting is in place.

Which version fixes the issue?

According to the record, the issue is fixed in Gogs 0.14.1. Versions 0.13.4 and below are described as affected.

Does CSRF protection stop this attack?

According to the advisory summarized in the record, CSRF tokens do not mitigate this issue because cookies are issued in a same-origin context.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.