CVE-2026-25242

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. This issue has been fixed in version 0.14.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Feb 19, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-252438.8Redis is an in-memory data structure store. In versions of redis-server up to 8.6.3, the RESTORE command does not properly validate serializ CVE-2026-252449.8WebdriverIO is a test automation framework for unit, e2e and component testing using WebDriver, WebDriver BiDi and Appium. Versions below 9.CVE-2026-25257.5A vulnerability has been found in Free5GC up to 4.1.0. This affects an unknown function of the component PFCP UDP Endpoint. Such manipulatio CVE-2026-252506.0EAZ EazyFix 12.9 allows a Security Feature Bypass related to a "Missing Cryptographic Step" associated with "Secure Boot disable."CVE-2026-252538.8OpenClaw (aka clawdbot or Moltbot) before 2026.1.29 obtains a gatewayUrl value from a query string and automatically makes a WebSocket conne CVE-2026-252549.8Improper authorization leads to Remote Code Execution via SocketIO interface.CVE-2026-252557.8Exposed dangerous function lead to privilege escalation via gRPC server.CVE-2026-252587.8Memory corruption while processing IOCTL calls for escape operations.CVE-2026-252597.8Memory corruption while processing multiple IOCTL command for escape operations.CVE-2026-25268.8A vulnerability was found in Wavlink WL-WN579A3 up to 20210219. This impacts the function multi_ssid of the file /cgi-bin/wireless.cgi. Perf CVE-2026-252607.0Memory Corruption when accessing shared buffers without validation of concurrent user-mode input modifications.CVE-2026-252617.8Memory corruption while processing rear sensor IOCTL calls.