PT-2026-6745 · Gogs · Gogs

Published 2026-02-06 · Updated 2026-03-03 · CVE-2025-64111

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.4 Gogs versions 0.14.0+dev

Description Gogs, a self-hosted Git service, is affected by a critical remote code execution (RCE) issue. This issue allows attackers to rewrite the .git/config file via an API, potentially injecting malicious Git configurations like sshCommand. Exploitation involves abusing a symlink and repository contents API to overwrite the .git/config file, leading to remote command execution during Git operations. The issue stems from an insufficient patch for a previously identified security advisory. The UpdateRepoFile function has a security check that is bypassed when called through the API router, allowing updates to the .git/config file. A proof-of-concept demonstrates the creation of a symlink, pushing it to the repository, and then updating the file via the API to inject malicious configuration.

Recommendations Upgrade to Gogs version 0.13.4 or later. Upgrade to Gogs version 0.14.0+dev or later.

Exploit

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2025-64111

GHSA-GG64-XXR9-QHJP

GO-2026-4448

SUSE-SU-2026:0757-1

Affected Products

Gogs

References · 121

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64111.json · Exploit
• https://github.com/gogs/gogs/security/advisories/GHSA-gg64-xxr9-qhjp · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64111 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-gg64-xxr9-qhjp · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4448 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64111 · Security Note
• https://github.com/gogs/gogs/blob/d940e692ec58abd45e648c054d7dfd88909034ec/internal/route/api/v1/repo/contents.go#L197-L206 · Note
• https://github.com/gogs/gogs · Note
• https://suse.com/security/cve/CVE-2026-25949 · Note
• https://suse.com/security/cve/CVE-2026-25889 · Note
• https://suse.com/security/cve/CVE-2026-26187 · Note
• https://suse.com/security/cve/CVE-2026-23989 · Note
• https://suse.com/security/cve/CVE-2026-22892 · Note
• https://suse.com/security/cve/CVE-2025-67860 · Note