Goal Reached Thanks to every supporter β€” we hit 100%!

Goal: 1000 CNY Β· Raised: 1000 CNY

100.0%

CVE-2026-25921 β€” AI Deep Analysis Summary

CVSS 9.3 Β· Critical

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Gogs < 0.14.2 suffers from **Data Forgery** (CWE-345). LFS objects from different repos can be overwritten. πŸ’₯ **Consequences**: Leads to **Supply Chain Attacks**.…

Q2Root Cause? (CWE/Flaw)

πŸ›‘οΈ **Root Cause**: **CWE-345** (Potential Code Injection/Data Forgery). The flaw lies in how LFS objects are handled across repositories, allowing cross-repo overwrites.…

Q3Who is affected? (Versions/Components)

πŸ‘₯ **Affected**: **Gogs (Go Git Service)**. πŸ“¦ **Versions**: All versions **prior to 0.14.2**. 🏒 **Vendor**: Gogs Team. Self-hosted Git service users are at risk.

Q4What can hackers do? (Privileges/Data)

πŸ•΅οΈ **Attacker Actions**: Overwrite LFS objects between repositories. πŸ“œ **Impact**: **High Integrity (I:H)** impact. Can inject malicious binaries or scripts into trusted projects.…

Q5Is exploitation threshold high? (Auth/Config)

⚑ **Threshold**: **Low**. CVSS: **AV:N/AC:L/PR:N/UI:N**. No authentication required. No user interaction needed. Network accessible. πŸšͺ **Entry**: Easy remote exploitation.

Q6Is there a public Exp? (PoC/Wild Exploitation)

πŸ§ͺ **Public Exp?**: **No PoCs listed** in data. However, GHSA advisory exists. 🌐 **Wild Exp**: Not confirmed public, but severity suggests high risk. Check GHSA-cj4v-437j-jq4c for details.

Q7How to self-check? (Features/Scanning)

πŸ” **Self-Check**: Scan for Gogs instances. πŸ“‹ **Version Check**: Verify if running < 0.14.2. πŸ“‚ **LFS Check**: Inspect Large File Storage configurations for cross-repo isolation failures. Use CVSS vector analysis.

Q8Is it fixed officially? (Patch/Mitigation)

βœ… **Fixed?**: **Yes**. πŸ› οΈ **Patch**: Upgrade to **Gogs v0.14.2**. πŸ”— **Ref**: See GitHub release notes and commit 81ee883. Official mitigation is available.

Q9What if no patch? (Workaround)

🚧 **No Patch?**: Isolate LFS storage. 🚫 **Restrict Access**: Limit network exposure if possible. πŸ‘€ **Monitor**: Watch for anomalous file changes in LFS directories. ⚠️ **Risk**: High exposure until patched.

Q10Is it urgent? (Priority Suggestion)

πŸ”₯ **Urgency**: **HIGH**. πŸ“… **Published**: 2026-03-05. πŸ“‰ **CVSS**: 7.5 (High). πŸš€ **Action**: Patch immediately. Supply chain risks are critical. Do not delay.