CVE-2026-25921 LFS Supply-Chain Object Overwrite

Deterministic critical Gogs Added 6mo ago cve-verified-cve-2026-25921

Detects vulnerable Gogs versions where LFS object uploads lack SHA256 content hash verification, allowing cross-repository object overwrite and supply-chain poisoning.

Related Gogs exploits

CVE-2025-8110 Symlink Path Traversal RCE

Is your app exploitable through CVE-2026-25921?

Scan your domain free