CVE-2026-25921 - NVD | ByteOS Network

NVD Vulnerability Details :

CVE-2026-25921

Analyzed

More Info Official Page

Source-security-advisories@github.com

Published At-05 Mar, 2026 | 19:16

Updated At-06 Mar, 2026 | 14:02

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2.

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	9.3	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L

Type: Secondary

Version: 3.1

Base score: 9.3

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L

CPE Matches

gogs>>gogs>>Versions before 0.14.2(exclusive)

cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-345	Primary	security-advisories@github.com

CWE ID: CWE-345

Type: Primary

Source: security-advisories@github.com

References

Hyperlink	Source	Resource
https://github.com/gogs/gogs/commit/81ee8836445ac888d99da8b652be7d5cbc5c4d5c	security-advisories@github.com	Patch
https://github.com/gogs/gogs/pull/8166	security-advisories@github.com	Issue Tracking
https://github.com/gogs/gogs/releases/tag/v0.14.2	security-advisories@github.com	Release Notes
https://github.com/gogs/gogs/security/advisories/GHSA-cj4v-437j-jq4c	security-advisories@github.com	Exploit Vendor Advisory Mitigation

Hyperlink: https://github.com/gogs/gogs/commit/81ee8836445ac888d99da8b652be7d5cbc5c4d5c

Source: security-advisories@github.com

Resource:

Patch

Hyperlink: https://github.com/gogs/gogs/pull/8166

Source: security-advisories@github.com

Resource:

Issue Tracking

Hyperlink: https://github.com/gogs/gogs/releases/tag/v0.14.2

Source: security-advisories@github.com

Resource:

Release Notes

Hyperlink: https://github.com/gogs/gogs/security/advisories/GHSA-cj4v-437j-jq4c

Source: security-advisories@github.com

Resource:

Exploit

Vendor Advisory

Mitigation