CVE Intelligence
Analysis AI-assisted

CVE-2026-25921: Gogs: cross-repository LFS object overwrite due to missing content hash verification

Gogs versions before 0.14.2 allow LFS objects to be overwritten across different repositories because content hash verification is missing. The record links this to a possible supply-chain attack and rates it critical with a CVSS base score of 9.3. The issue is fixed in 0.14.2, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

Gogs is a self-hosted Git service. This CVE describes a flaw in which LFS objects can be overwritten across different repositories because content hash verification is missing. The record classifies the weakness as CWE-345, Insufficient Verification of Data Authenticity.

Impact

  • According to the record, an attacker who overwrites LFS objects could carry out a supply-chain attack.
  • The record gives a CVSS base score of 9.3, which is rated critical.
  • The SSVC technical impact field is recorded as partial.

Affected products and versions

  • Gogs (product Gogs Gogs) is affected in versions before 0.14.2, according to the record.
  • The record states that the issue has been patched in 0.14.2. Recommending 0.14.2 or a later release is our inference.

Exploitation status

CISA KEV does not list this CVE. No confirmed exploitation in the wild appears in the sources consulted. The SSVC exploitation field is recorded as poc, which indicates a proof-of-concept condition and is not evidence of observed attacks. The EPSS probability is 0.00291, with a percentile of 0.20557.

Remediation and mitigation

  • Upgrade Gogs to 0.14.2 or a later release that includes the fix.
  • Review the vendor advisory for its mitigation guidance: GHSA-cj4v-437j-jq4c
  • Review the patch commit to understand the change: Patch commit

Detection guidance

  • Audit LFS object storage for unexpected changes to existing object content, especially objects shared across repositories.
  • Where expected hashes are available, compare stored LFS objects against them. This is a high-level check only.

Limitations of the available information

  • The record does not describe the technical mechanics beyond the summary; the fix details are only in the linked commit.
  • No affected version ranges beyond those in the record are given.
  • Whether any instance has already been affected or compromised is unknown.

Frequently asked questions

Which Gogs versions are affected by CVE-2026-25921?

According to the record, Gogs versions before 0.14.2 are affected. The issue is stated to be patched in 0.14.2.

Is this CVE known to be actively exploited?

CISA KEV does not list it, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC field records a proof-of-concept status, which is different from observed attacks.

What should administrators do?

Upgrade Gogs to 0.14.2 or a later release that includes the fix, and review the vendor advisory and patch commit linked in the references.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.