Vulnerability Description
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Gogs | Gogs | < 0.14.2 |
Related Weaknesses (CWE)
References
- https://github.com/gogs/gogs/commit/81ee8836445ac888d99da8b652be7d5cbc5c4d5cPatch
- https://github.com/gogs/gogs/pull/8166Issue Tracking
- https://github.com/gogs/gogs/releases/tag/v0.14.2Release Notes
- https://github.com/gogs/gogs/security/advisories/GHSA-cj4v-437j-jq4cExploitVendor AdvisoryMitigation
FAQ
What is CVE-2026-25921?
CVE-2026-25921 is a vulnerability with a CVSS score of 9.3 (CRITICAL). Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously o...
How severe is CVE-2026-25921?
CVE-2026-25921 has been rated CRITICAL with a CVSS base score of 9.3/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-25921?
Check the references section above for vendor advisories and patch information. Affected products include: Gogs Gogs.