https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-05T08:09:30.080367+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-05190 bdu:2026-05190 2026-10-05T08:09:30.145460+00:00 bdu:2026-05190 https://cve.radiocsirt.org/vuln/euvd-2026-274839 EUVD-2026-274839 2026-10-05T08:09:30.145497+00:00 EUVD-2026-274839 https://cve.radiocsirt.org/vuln/fkie_cve-2026-25921 fkie_cve-2026-25921 2026-10-05T08:09:30.145512+00:00

Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2.

 https://cve.radiocsirt.org/vuln/ghsa-cj4v-437j-jq4c GHSA-cj4v-437j-jq4c — Gogs: Cross-repository LFS object overwrite via missing content hash verification 2026-10-05T08:09:30.145542+00:00

Affected: Go: gogs.io/gogs

### Summary Overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers.

### Details Gogs store all LFS objects in the same place, no isolation between different repositories. (repo id not concatenated to storage path) https://github.com/gogs/gogs/blob/7a2dffa95ac64f31c8322cb50d32694b05610144/internal/lfsutil/storage.go#L52-L58

Gogs does not verify uploaded LFS file content against its claimed SHA-256, meaning attackers can manipulate the uploaded file like injecting backdoor. https://github.com/gogs/gogs/blob/7a2dffa95ac64f31c8322cb50d32694b05610144/internal/lfsutil/storage.go#L79-L89

Here's the comment that trust client to retry upload allowing them to overwrite. However, this assumption does not hold in the case of a malicious client. https://github.com/gogs/gogs/blob/7a2dffa95ac64f31c8322cb50d32694b05610144/internal/route/lfs/basic.go#L111-L113

### PoC

``` # ./gogs -v Gogs version 0.13.0 ```

#### 1. User (admin1) upload a LFS object into their repository `admin1/testlfs.git` normally

``` POST http://172.29.121.170/admin1/testlfs.git/info/lfs/objects/batch User-Agent: git-lfs/3.0.2 (GitHub; linux amd64; go 1.17.2) Accept-Encoding: gzip, deflate, br Accept: application/vnd.git-lfs+json Connection: keep-alive Content-Type: application/vnd.git-lfs+json Authorization: Basic YWRtaW4xOjg2ZjgxMmNkNDBiODY1YmIzZGQ1NTgyNDI2OTE2M2FmNDM3ZGZjZWI= Content-Length: 168

{"operatio…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0623 WID-SEC-W-2026-0623 — Gogs: Mehrere Schwachstellen 2026-10-05T08:09:30.145598+00:00

Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder vertrauliche Informationen offenzulegen.