CVE-2026-25921

Gogs: Cross-repository LFS object overwrite via missing content hash verification

State: Published
Severity: 9.3 Critical
Published: Mar 5, 2026
Updated: Mar 6, 2026
Reserved: Feb 9, 2026

Description

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2.

Scores

CVSS	Score	Vector	Source
3.1	9.3 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L	GitHub_M

Weaknesses

CWE-345 Insufficient Verification of Data Authenticity

Affected Products

Product	Versions
gogsgogs	< 0.14.2Affected

References

https://github.com/gogs/gogs/security/advisories/GHSA-cj4v-437j-jq4c
https://github.com/gogs/gogs/pull/8166
https://github.com/gogs/gogs/commit/81ee8836445ac888d99da8b652be7d5cbc5c4d5c
https://github.com/gogs/gogs/releases/tag/v0.14.2

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.