Vulnerability GHSA-263q-5cv3-xq9g
High Risk
HIGH RISK
CVSS Score: 8.2
Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
10 months ago
December 26, 2025 at 03:30 AM UTC
Gitea allows attackers to add attachments with forbidden file extensions
v0.9.99 - v1.23.0-dev
v0.9.99 - v1.23.0-dev
Summary
Gitea allows attackers to add attachments with forbidden file extensions
Details
Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
1 month ago
Gitea tracked-time deletion is not scoped to the requested issue in code.gitea.io/gitea
v0.9.99 - v1.25.4 GO-2026-6343
v0.9.99 - v1.25.4 GO-2026-6343
Unknown
1 month ago
Gitea LFS mirror operations bypass migration HTTP transport protections in code.gitea.io/gitea
v0.9.99 - v1.25.4 GO-2026-6344
v0.9.99 - v1.25.4 GO-2026-6344
Unknown
1 month ago
Gitea forwarded-proto validation allows canonical URL spoofing in code.gitea.io/gitea
v0.9.99 - v1.25.4 GO-2026-6345
v0.9.99 - v1.25.4 GO-2026-6345
Unknown
1 month ago
Gitea pre-receive hook scanner errors allow branch-protection bypass in code.gitea.io/gitea
v0.9.99 - v1.26.0-rc0 GO-2026-6346
v0.9.99 - v1.26.0-rc0 GO-2026-6346
Unknown
1 month ago
Gitea draft releases and attachments are exposed without write permission in code.gitea.io/gitea
v0.9.99 - v1.25.4 GO-2026-6347
v0.9.99 - v1.25.4 GO-2026-6347
Impacted packages
Timeline
Published
10 months ago
December 26, 2025 at 03:30 AM UTC
Fixed (v1.23.0-rc0)
1 year ago
December 17, 2024 at 04:00 AM UTC
Last Modified
17 hours ago
November 03, 2026 at 04:45 PM UTC