CVE-2025-68939

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.23.0

Description A flaw exists that enables attackers to add attachments with file extensions that are normally prohibited. This is achieved by modifying the attachment name through the attachment API. The affected API endpoint is the attachment API. Attackers manipulate the filename parameter to bypass file extension restrictions.

Recommendations Update to version 1.23.0 or later.