Gogs, the lightweight open-source self-hosted Git service, has released version 0.14.2 patching six security vulnerabilities ranging from a supply chain-relevant LFS object overwrite to multiple stored XSS issues and API token leakage. Gogs is a widely deployed alternative to GitHub Enterprise and GitLab in developer environments where resource constraints favor its minimal footprint. This release should be treated as a priority patch for any organization running an internet-exposed or internally accessible Gogs instance.
CVE-2026-25921: LFS Object Overwrite Enabling Supply Chain Attack
The most significant vulnerability in this batch is CVE-2026-25921, which allows overwriting of Git Large File Storage (LFS) objects across different repositories. Because LFS objects are content-addressable and shared by hash, a malicious actor who can write an LFS object to one repository can potentially overwrite an object with the same hash used by a different repository. This creates a viable supply chain attack surface: an attacker with write access to any repository on the instance could corrupt or replace LFS-stored artifacts (binaries, compiled assets, release archives) consumed by other projects. The impact in CI/CD pipelines that rely on Gogs as a source of truth for LFS-stored build artifacts or release binaries is potentially severe.
XSS Cluster: CVE-2026-26022, CVE-2026-26195, CVE-2026-26276
Three stored cross-site scripting vulnerabilities were patched in this release:
- CVE-2026-26022: Stored XSS in comment and issue description fields, exploitable by any user with permission to create comments or issues.
- CVE-2026-26195: Stored XSS via unsafe template rendering that mixes user input with safe template output, indicating a broader template escaping gap rather than a single input field issue.
- CVE-2026-26276: Stored XSS via repository Milestone names, triggered when an administrator or contributor views the Milestones page.
Stored XSS in a self-hosted Git platform is particularly impactful because the likely victim population includes administrators and developers with elevated repository access. A successful XSS payload could be used for session hijacking, credential theft, or as a stepping stone to repository-level access.
CVE-2026-26196: API Token Leakage via URL Parameters
CVE-2026-26196 addresses a design flaw where the Gogs API continues to accept authentication tokens passed as URL query parameters via token and access_token. Tokens embedded in URLs are routinely logged by web servers, reverse proxies, CDNs, and browser history, making this a persistent credential exposure risk. Any token passed via URL may have been logged in plaintext across the infrastructure chain between client and server.
CVE-2026-26194: Release Deletion Failure via User-Controlled Tag Names
CVE-2026-26194 describes a condition where deleting a release can fail if the associated tag name contains characters controlled by the user. While lower severity, this creates a potential denial of administrative function and could be used to prevent cleanup of malicious or unwanted releases.
Remediation
All six vulnerabilities are fixed in Gogs 0.14.2. Given the prior history of actively exploited Gogs vulnerabilities (including CVE-2025-8110, which was added to the CISA KEV catalog in January 2026 and saw over 700 compromised instances), Gogs administrators should treat this update as urgent. Organizations unable to upgrade immediately should restrict instance access to authenticated users behind a VPN or IP allowlist, which eliminates most of the XSS and token leakage exposure and reduces the LFS supply chain risk surface.
This article is published for threat intelligence purposes. IntelFusions is not affiliated with any threat actor group. Claims described herein have not been independently verified unless explicitly stated.