CVE-2026-25921: Gogs: Cross-repository LFS object overwrite via missing content hash verification

March 5, 2026

Overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers.

References

github.com/advisories/GHSA-cj4v-437j-jq4c
github.com/gogs/gogs
github.com/gogs/gogs/commit/81ee8836445ac888d99da8b652be7d5cbc5c4d5c
github.com/gogs/gogs/pull/8166
github.com/gogs/gogs/releases/tag/v0.14.2
github.com/gogs/gogs/security/advisories/GHSA-cj4v-437j-jq4c
nvd.nist.gov/vuln/detail/CVE-2026-25921

Code Behaviors & Features

Detect and mitigate CVE-2026-25921 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →