CVE-2025-68937CWE-61

CVE-2025-68937

published December 26, 2025

CVSS
9.5
EPSS
1%
Percentile
42.0
In the wild
Unconfirmed
What it is

Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for template repositories. This is also fixed for 11 LTS in 11.0.7 and later.

The record
Technical detail
CVSS
9.5 · NONE
CVSS v4.0
Not supplied
EPSS
0.00501 · 42.0th percentile
Weakness
CWE-61 · UNIX Symbolic Link (Symlink) Following
Published
2025-12-26T05:16Z
References (6)
https://blog.gitea.com/release-of-1.24.7/ · [email protected]https://codeberg.org/forgejo/forgejo/milestone/27340 · [email protected]https://codeberg.org/forgejo/forgejo/milestone/29156 · [email protected]https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/11.0.7.md · [email protected]https://codeberg.org/forgejo/forgejo/src/branch/forgejo/release-notes-published/13.0.2.md · [email protected]https://codeberg.org/forgejo/security-announcements/issues/43 · [email protected]
EPSS history
Timeline
  • 25 DEC 23:57Z
    Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository…
    cvelistv5