What is CVE-2025-68937?

CVE-2025-68937 is a vulnerability in Forgejo, classified under UNIX Symbolic Link (Symlink) Following. Published 2025-12-26.

Is CVE-2025-68937 known to be exploited?

2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Forgejo

CVE-2025-68937

Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for template repositories. This is also fixed for 11 LTS in 11.0.7 and later.

EPSS: 0.005 (37.8th percentile) — read the EPSS interpretation.

Affected products

Forgejo — versions 12.0.0, 0

Weakness classification (CWE)

CWE-61 — UNIX Symbolic Link (Symlink) Following

Public proof-of-concept exploits

Scratchappy/CVE-2025-68937
ClemaX/Gitea-Forgejo-CVE-2025-68937

References

cve@mitre.org
cve@mitre.org
cve@mitre.org
cve@mitre.org
cve@mitre.org
cve@mitre.org

Frequently asked questions

What is CVE-2025-68937?: CVE-2025-68937 is a vulnerability in Forgejo, classified under UNIX Symbolic Link (Symlink) Following. Published 2025-12-26.
Is CVE-2025-68937 known to be exploited?: 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.