Skip to content

Commit 77cf8b0

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-263q-5cv3-xq9g GHSA-rrcw-5rjv-vj26 GHSA-xfq3-qj7j-4565
1 parent bb6e88d commit 77cf8b0

File tree

3 files changed

+87
-12
lines changed

3 files changed

+87
-12
lines changed

advisories/unreviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json renamed to advisories/github-reviewed/2025/12/GHSA-263q-5cv3-xq9g/GHSA-263q-5cv3-xq9g.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-263q-5cv3-xq9g",
4-
"modified": "2025-12-26T03:30:15Z",
4+
"modified": "2025-12-26T19:12:02Z",
55
"published": "2025-12-26T03:30:15Z",
66
"aliases": [
77
"CVE-2025-68939"
88
],
9+
"summary": "Gitea allows attackers to add attachments with forbidden file extensions",
910
"details": "Gitea before 1.23.0 allows attackers to add attachments with forbidden file extensions by editing an attachment name via an attachment API.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:L"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "code.gitea.io/gitea"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
}
30+
]
31+
}
32+
],
33+
"database_specific": {
34+
"last_known_affected_version_range": "< 1.23.0"
35+
}
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -27,6 +48,10 @@
2748
"type": "WEB",
2849
"url": "https://blog.gitea.com/release-of-1.23.0"
2950
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/go-gitea/gitea"
54+
},
3055
{
3156
"type": "WEB",
3257
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.23.0"
@@ -37,8 +62,8 @@
3762
"CWE-424"
3863
],
3964
"severity": "HIGH",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-12-26T19:12:02Z",
4267
"nvd_published_at": "2025-12-26T03:15:50Z"
4368
}
4469
}

advisories/unreviewed/2025/12/GHSA-rrcw-5rjv-vj26/GHSA-rrcw-5rjv-vj26.json renamed to advisories/github-reviewed/2025/12/GHSA-rrcw-5rjv-vj26/GHSA-rrcw-5rjv-vj26.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-rrcw-5rjv-vj26",
4-
"modified": "2025-12-26T03:30:15Z",
4+
"modified": "2025-12-26T19:12:24Z",
55
"published": "2025-12-26T03:30:15Z",
66
"aliases": [
77
"CVE-2025-68940"
88
],
9+
"summary": "Gitea doesn't adequately enforce branch deletion permissions after merging a pull request.",
910
"details": "In Gitea before 1.22.5, branch deletion permissions are not adequately enforced after merging a pull request.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "code.gitea.io/gitea"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.22.5"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -27,6 +48,10 @@
2748
"type": "WEB",
2849
"url": "https://blog.gitea.com/release-of-1.22.5"
2950
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/go-gitea/gitea"
54+
},
3055
{
3156
"type": "WEB",
3257
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.22.5"
@@ -37,8 +62,8 @@
3762
"CWE-863"
3863
],
3964
"severity": "LOW",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-12-26T19:12:24Z",
4267
"nvd_published_at": "2025-12-26T03:15:50Z"
4368
}
4469
}

advisories/unreviewed/2025/12/GHSA-xfq3-qj7j-4565/GHSA-xfq3-qj7j-4565.json renamed to advisories/github-reviewed/2025/12/GHSA-xfq3-qj7j-4565/GHSA-xfq3-qj7j-4565.json

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,40 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-xfq3-qj7j-4565",
4-
"modified": "2025-12-26T03:30:15Z",
4+
"modified": "2025-12-26T19:12:54Z",
55
"published": "2025-12-26T03:30:15Z",
66
"aliases": [
77
"CVE-2025-68941"
88
],
9+
"summary": "Gitea mishandles access to a private resource upon receiving an API token with scope limited to public resources",
910
"details": "Gitea before 1.22.3 mishandles access to a private resource upon receiving an API token with scope limited to public resources.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V3",
1314
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N"
1415
}
1516
],
16-
"affected": [],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Go",
21+
"name": "code.gitea.io/gitea"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "1.22.3"
32+
}
33+
]
34+
}
35+
]
36+
}
37+
],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
@@ -27,6 +48,10 @@
2748
"type": "WEB",
2849
"url": "https://blog.gitea.com/release-of-1.22.3"
2950
},
51+
{
52+
"type": "PACKAGE",
53+
"url": "https://github.com/go-gitea/gitea"
54+
},
3055
{
3156
"type": "WEB",
3257
"url": "https://github.com/go-gitea/gitea/releases/tag/v1.22.3"
@@ -37,8 +62,8 @@
3762
"CWE-863"
3863
],
3964
"severity": "MODERATE",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
65+
"github_reviewed": true,
66+
"github_reviewed_at": "2025-12-26T19:12:54Z",
4267
"nvd_published_at": "2025-12-26T03:15:50Z"
4368
}
4469
}

0 commit comments

Comments
 (0)