CVE-2025-68939
Description
A flaw was found in Gitea. An attacker can exploit this issue by editing an attachment name via the attachment API, allowing attachments with forbidden file extensions to be added, bypassing security controls and potentially resulting in unauthorized data modification or execution of malicious content.
Statement
While this issue allows a forbidden file to exist in the server, it does not automatically execute it. An attack depends on how the underlying server is configured, such as the availability of script interpreters or directories with execute permissions, limiting the likelihood of a successful exploitation. Additionally, an attacker must convince a user to click, download or open the renamed attachment, limiting the impact of this issue. Due to these reasons, this flaw has been rated with an important severity.
Mitigation
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 8.2 | 5.3 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | High | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | Required | None | N/A |
| Scope | Changed | Unchanged | N/A |
| Confidentiality | High | None | N/A |
| Integrity Impact | High | Low | N/A |
| Availability Impact | Low | None | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Red Hat CVSS v3 Score Explanation
An attack depends on how the underlying server is configured, such as the availability of script interpreters or directories with execute permissions. Also, an attacker must convince a user to click, download or open the renamed attachment to exploit this flaw. To reflect these conditions, the attack complexity metric is set to high and the user interaction metric is set to required. Additionally, as this issue allows execution of malicious content, the confidentiality and the integrity metrics are set to high, and the availability metric is set to low.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
