# CVE-2026-25242: gogs CSRF — Fixed in 0.14.1

🐹 Go

Not in CISA KEV

# CVE-2026-25242 — gogs

[Fix: gogs/gogs@628216d](https://github.com/gogs/gogs/commit/628216d5889fcb838c471f4754f09b935d9cd9f3)

CVE-2026-25242 is a CWE-862 vulnerability in gogs.io/gogs. A fix is available for gogs.io/gogs — see the affected versions and patch details below.

Gogs allows unauthenticated file uploads

Also known as[GHSA-fc3h-92p8-h36f](/vulnerability/GHSA-fc3h-92p8-h36f)GO-2026-4500

Published

Feb 19, 2026

Updated

Oct 28, 2026

Affected

1 pkg

Patched

1 / 1

Exploits

None indexed

Exploitation data as of Nov 3, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

## Exploitation Status

### No confirmed exploitation observed yet

-   CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
-   CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-25242.

## EPSS Exploitation Probability

[via FIRST.org ↗](https://www.first.org/epss/)

0.7%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs52th percentile — riskier than 52% of all scored CVEsHighest risk

0.00%0.39%0.79%1.18%0.1%0.7%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/).

## Real-World Exposure

1 pkg affected

🐹`gogs.io/gogs`

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.

## Description

Security Advisory:Unauthenticated File Upload in Gogs Vulnerability Type: Unauthenticated File Upload Date: Aug 5, 2025 Discoverer: OpenAI Security Research

### Summary

Gogs exposes unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance.

### Affected Versions

-   Software: [Gogs](https://github.com/gogs/gogs/tree/main)
-   Confirmed Version(s): 28f83626d4ed0aa7b89493be2ea8b79ca038331e
-   Likely Affected: All versions since 2020-04-05 with unauthenticated attachments endpoints
-   Introduced Commit: 07818d5fa

### Vulnerability Details

The web.go router exposes the following endpoints under the ignSignIn route group:

#### Vulnerable Code Snippet

```
m.Post("/issues/attachments", repo.UploadIssueAttachment)
m.Post("/releases/attachments", repo.UploadReleaseAttachment)
```

These endpoints are accessible by unauthenticated users if the configuration variable RequireSigninView is false (default). This allows arbitrary file uploads to data/attachments, returning a UUID in response.

While CSRF protection is enabled, attackers can obtain a valid token anonymously from the site and use it in the upload request without authentication.

### Description

Anonymous file upload using only default configuration and a CSRF token obtained from the homepage.

### POC

```
# Run Gogs docker 
docker start gogs

# Software will be run on http://localhost:10880/. Finish the setup with local Sqlite database

# Get CSRF cookie into a jar
curl -sS -c cookies.txt http://localhost:10880/ -o /dev/null

# Extract the _csrf value from the jar
CSRF="$(awk '$6=="_csrf"{print $7}' cookies.txt | tail -n1)"

# Upload the file, sending cookie jar + header
curl -sS \
  -b cookies.txt -c cookies.txt \
  -H "X-CSRF-Token: $CSRF" \
  -H "Referer: http://localhost:10880/" \
  -F "file=@image.png" \
  http://localhost:10880/issues/attachments

 => {"uuid":"<UUID>"}
```

The attachment will be available at: [http://localhost:10880/attachments/](http://localhost:10880/attachments/)<uuid>

### Impact

**Unrestricted File Upload:** Attackers can store arbitrary content on the server. **Denial-of-Service:** Repeated uploads can exhaust disk space. **Malware Hosting:** Gogs may inadvertently serve attacker-hosted payloads under its domain.

### Realistic Exploitation Scenarios

-   Spammers or malicious actors use the Gogs instance to host phishing payloads or malware.
-   Attackers fill up disk with repeated uploads.
-   Attackers use hosted Gogs instances as public file dumps (e.g., for P2P, exfiltration)

### Potential Impact

This unauthenticated upload vector effectively turns any Gogs instance into a file hosting platform open to the public. This is especially dangerous for production or Internet-exposed installations. The combination of no login requirement, wildcard MIME support, and unrestricted access to attachments enables both resource abuse and potential malware distribution.

### Timeline

-   August 2025: Discovered via GPT5
-   August 2025: Reproduced and confirmed via PoC and sanitizer
-   Aug 6, 2025 - Sent to Gogs via [https://github.com/gogs/gogs/security/advisories/new](https://github.com/gogs/gogs/security/advisories/new)

## Affected Packages

1 total 1 fixed

Ecosystem

Package

Vulnerable range

Fix

🐹Go

`gogs.io/gogs` 

all versions

0.14.1`go get gogs.io/gogs@v0.14.1`

## Affected Products

1 product · 1 configurations

Application

`gogs`gogs

< 0.14.1

range

## Detection & mitigation playbook

Open-source dependency

1.  ### Detect
    
    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for gogs.io/gogs, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
    
2.  ### Fix
    
    Update gogs.io/gogs to 0.14.1 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-25242 is resolved across your whole dependency graph.
    
3.  ### Workarounds
    
    Treat uploaded files as untrusted until proven otherwise: validate the actual content type rather than the supplied extension, store uploads outside the web root on a volume mounted without execute permission, and rename them to server-generated identifiers so an attacker cannot choose the path a request will later resolve.
    

## Frequently Asked Questions

Security Advisory:Unauthenticated File Upload in Gogs Vulnerability Type: Unauthenticated File Upload Date: Aug 5, 2025 Discoverer: OpenAI Security Research ## Summary Gogs exposes unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-

O3 Security · Impact-Aware SCA

### Is CVE-2026-25242 in your dependencies?

Find it across Go, including transitive dependencies.

[Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)