CVE-2025-68946

Published December 26th, 2025

View on NVD ↗

CVSS v3

5.4

MEDIUM

CVSS v2

N/A

Affected

PROJECT

Description

In Gitea before 1.20.1, a forbidden URL scheme such as javascript: can be used for a link, aka XSS.

go-gitea/gitea

Git with a cup of tea! Painless self-hosted all-in-one software development service, including Git hosting, code review, team collaboration, package registry and CI/CD

GitHub

56.5K