CVE-2026-25242 affects Gogs 0.13.4 and earlier, the self-hosted Git service. Two attachment endpoints accept uploads from unauthenticated users when RequireSigninView is off, which is the default. NVD rates it critical at 9.8. Version 0.14.1 fixes it, and enabling the sign-in requirement closes the exposure on private instances.
What's affected
- Product: Gogs, an open source self-hosted Git service.
- Affected: 0.13.4 and below, with the global RequireSigninView setting disabled (the default).
- Fixed: 0.14.1.
- Endpoints named in the advisory: the release and issue attachment upload paths.
How to check if you're exposed
Find your Gogs version in the admin dashboard or from the binary, then read your configuration for the sign-in requirement:
./gogs --version
grep -n REQUIRE_SIGNIN_VIEW custom/conf/app.ini
If the setting is false or absent and you run 0.13.4 or earlier, anonymous uploads are possible. Also check the attachments directory under your data path for files nobody on your team uploaded.
What to do now
- Upgrade to Gogs 0.14.1 or later.
- Set REQUIRE_SIGNIN_VIEW to true in app.ini if your instance is not meant to be public, then restart.
- List and review the contents of the data attachments directory and remove anything unexpected.
- Set disk usage alerts, since the advisory names disk exhaustion as a consequence.
- Restrict access to the instance at the network edge if only staff use it.
Why it matters
This is a missing authorization problem, CWE-862. Routes that should require a signed in user were reachable by anyone, and the advisory notes that CSRF tokens do not help because the same origin issues the cookie to any visitor.
The advisory frames the impact as abuse: free file hosting, disk exhaustion and delivery of malware from your domain. That is a reputation and availability problem rather than direct code execution. It is not marked as exploited in the wild in the record.
Quick check
Is my private Gogs instance safe if it sits behind a VPN?
It lowers exposure, but anyone who can reach the instance, including a compromised internal host, could use the endpoints. Upgrade anyway.
Sources
Last reviewed: 19 October 2026.
