CVE-2025-68939

MediumCVSS 5.3/10Last modified Oct 13, 2026

Description

Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Weakness enumeration

CWE-424

Affected software

No affected versions have been published.

Timeline

Published
Dec 26, 2025
Last modified
Oct 13, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-68945.3An Execution with Unnecessary Privileges vulnerability has been identified in Moxa’s network security appliances and routers. A flaw in the CVE-2025-689405.3In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.CVE-2025-689415.3Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.CVE-2025-689425.4Gitea before 1.22.2 allows XSS because the search input box (for creating tags and branches) is v-html instead of v-text.CVE-2025-689435.3Gitea before 1.21.8 inadvertently discloses users' login times by allowing (for example) the lastlogintime explore/users sort order.CVE-2025-689445.3Gitea before 1.22.2 sometimes mishandles the propagation of token scope for access control within one of its own package registries.CVE-2025-689455.3In Gitea before 1.21.2, an anonymous user can visit a private user's project.CVE-2025-689465.4In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.CVE-2025-689474.7NSecsoft 'NSecKrnl' is a Windows driver that allows a local, authenticated attacker to terminate processes owned by other users, including SCVE-2025-689488.1SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizesCVE-2025-689495.3n8n is an open source workflow automation platform. From 1.36.0 to before 2.2.0, the Webhook node’s IP whitelist validation performed partiaCVE-2025-68959.8The Melapress Login Security plugin for WordPress is vulnerable to Authentication Bypass due to missing authorization within the get_valid_u
CVE-2025-68939: Medium severity, CVSS 5.3 | Vulnix