Skip to content
OpenAdvisories
High WID-SEC-2025-2925 10 CVEs

Gitea: Mehrere Schwachstellen

Published Dec 28, 2025 · Updated Jul 5, 2026 · Revision 2 · de-DE

Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, und um Dateien zu manipulieren.

Product

Gitea ist ein quelloffener Github-Klon.

Vulnerabilities 10

  • Critical 9.5
    CVE-2025-68937 Public exploit

    Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because o…

    forgejo forgejo
  • High 8.2
    CVE-2025-68939

    Gitea allows attackers to add attachments with forbidden file extensions

    Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

    Gitea Gitea code.gitea.io/gitea Go
  • Medium 5.8
    CVE-2025-68945

    Gitea: anonymous user can visit private user's project

    In Gitea before 1.21.2, an anonymous user can visit a private user's project.

    Gitea Gitea code.gitea.io/gitea Go
  • Medium 5.4
    CVE-2025-68942

    Gitea allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text

    Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.

    Gitea Gitea code.gitea.io/gitea Go
  • Medium 5.4
    CVE-2025-68946

    Gitea vulnerable to Cross-site Scripting

    In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

    Gitea Gitea code.gitea.io/gitea Go
  • Medium 5.3
    CVE-2025-68943

    Gitea inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order

    Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.

    Gitea Gitea code.gitea.io/gitea Go
  • Medium 5.0
    CVE-2025-68944

    Gitea sometimes mishandles propagation of token scope for access control within one of its own package registries

    Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.

    Gitea Gitea code.gitea.io/gitea Go
  • Medium 4.9
    CVE-2025-68941

    Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources

    Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.

    Gitea Gitea code.gitea.io/gitea Go
  • Medium 4.3
    CVE-2025-68938

    Gitea mishandles authorization for deletion of releases

    Gitea before 1.25.2 mishandles authorization for deletion of releases.

    Gitea Gitea code.gitea.io/gitea Go
  • Low 3.1
    CVE-2025-68940

    Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.

    In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.

    Gitea Gitea code.gitea.io/gitea Go

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-41623

  2. #1

    Initiale Fassung

References