Unauthenticated File Upload in Gogs
Date: 2026-02
Affected: go/gogs.io/gogs
Attack vector: malware
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-25242
CWE: CWE-862

Security Advisory:Unauthenticated File Upload in Gogs Vulnerability Type: Unauthenticated File Upload Date: Aug 5, 2025 Discoverer: OpenAI Security Research ## Summary Gogs exposes unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance. ## Affected Versions - Software: [Gogs](https://github.com/gogs/gogs/tree/main) - Confirmed Version(s): 28f83626d4ed0aa7b89493be2ea8b79ca038331e - Likely Affected: All versions since 2020-04-05 with unauthenticated attachments endpoints - Introduced Commit: 07818d5fa ## Vulnerability Details The web.go router exposes the following endpoints under the ignSignIn route group: ### Vulnerable Code Snippet ``` m.Post("/issues/attachments", repo.UploadIssueAttachment) m.Post("/releases/attachments", repo.UploadReleaseAttachment) ``` These endpoints are accessible by unauthenticated users if the configuration variable RequireSigninView is false (default). This allows arbitrary file uploads to data/attachments, returning a UUID in response. While CSRF protection is enabled, attackers can obtain a valid token anonymously from the site and use it in the upload request w


Mitigations:

Architectural layers (MAESTRO):