Vulnerability advisory
CVE-2025-68946
Also known as BIT-gitea-2025-68946GHSA-hq57-c72x-4774GO-2025-4265
Severity
- CVSS 3.x
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected versions
Repository
| Affected commits | Fixed by commit |
|---|---|
| GIT github.com/go-gitea/gitea ↗ | |
| 90a7bba1f2af1b0d0ba762fc2e1f5b3878b7dbe8 to before 221b90d2891025b08cd083bb821d91a7f5722341 | 221b90d2891025b08cd083bb821d91a7f5722341 |
Also listed as affected (6)
| |
Description
In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.