Gitea Web Release Edit Form Vulnerability Under Investigation
An early warning has been issued regarding a potential vulnerability in Gitea's web release edit form, which may allow renaming release attachments to forbidden extensions, bypassing the allowlist. This issue is reportedly a variant of CVE-2025-68939, which was previously fixed on the API path but not on the web path. Users of affected Gitea versions are advised to upgrade to the latest version to mitigate potential risks.
What happened
The reported vulnerability in Gitea's web release edit form allows users to rename release attachments to extensions that are not permitted by the allowlist. This bypass could potentially lead to security risks, as it may enable the upload of malicious files under the guise of legitimate attachments. The issue appears to be a variant of CVE-2025-68939, which was addressed in the API path but not in the web path.
Affected versions of Gitea include a wide range of releases, from v1.22.0-rc1 down to v0.9.99. The vulnerability is under investigation, and it is recommended that users of these versions upgrade to the latest release of Gitea to ensure that the web release edit form is patched. For detailed version information and to confirm if your specific version is affected, please consult the primary sources provided.
As this is an early warning, the full extent of the vulnerability and its potential impact are still being assessed. Users are encouraged to stay informed by monitoring updates from official Gitea channels and applying patches as soon as they become available. Further details on the vulnerability and its implications should be sought from the primary sources listed.
How 0Day mitigates this
gitea is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.