CVE-2026-25921

Gogs does not sufficiently verify whether the uploaded LFS object belongs to the repository to which it is being uploaded (CWE-345: insufficient data authenticity verification). An attacker, by uploading an LFS object with an appropriately chosen hash, can overwrite an existing LFS object assigned to another repository. Since LFS objects are shared in an unisol ated manner, modification of one object affects all repositories using that resource. This results in the possibility of substituting, for example, binary files or libraries downloaded by users of other projects.

An attacker can maliciously overwrite any LFS object within a Gogs instance, leading to a supply chain attack — users downloading resources from other repositories may unknowingly receive modified, potentially harmful files. The integrity of stored artifacts is compromised at the instance level.

Gogs should be updated to version 0.14.2 or later, where the issue has been fixed. The patch is available in the official v0.14.2 release and as commit 81ee8836445ac888d99da8b652be7d5cbc5c4d5c in the vendor's repository.

Gogs in versions prior to 0.14.2 — all instances using Git LFS functionality