CVE-2025-64111: 
Gogs vulnerability analysis and mitigation

CVE-2025-64111 is a critical OS command injection vulnerability in Gogs, an open-source self-hosted Git service, that allows unauthenticated remote code execution via manipulation of the .git/config file through the repository contents API. It is a bypass of the incomplete patch for CVE-2024-56731 (GHSA-wj44-9vcg-wjq7), affecting Gogs versions 0.13.3 and prior. The vulnerability was disclosed on February 6, 2026, and has a CVSS v3.1 base score of 9.8 (Critical) and a CVSS v4.0 base score of 9.3 (Critical) (GitHub Advisory, Gogs Advisory).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). The UpdateRepoFile function in internal/route/api/v1/repo/contents.go (lines 197–206) performs security checks under certain conditions, but the API router code path bypasses these checks entirely, allowing an attacker to update the .git/config file via the PUT /api/v1/repos/{owner}/{repo}/contents/{path} endpoint. An attacker can first push a symlink (e.g., link -> .git/config) to a repository, then use the API to overwrite the symlink target with a malicious .git/config containing an injected sshCommand directive, which executes arbitrary OS commands when Git SSH operations are triggered. No authentication is required beyond a valid API token, which can be obtained via a free account on public Gogs instances (Gogs Advisory, GitHub Advisory).

Successful exploitation grants an attacker full remote code execution on the Gogs server with the privileges of the Gogs service account, resulting in high confidentiality, integrity, and availability impact. An attacker can exfiltrate all hosted source code and secrets, tamper with repository data, disrupt service availability, and potentially pivot laterally within the infrastructure hosting the Gogs instance. All Git repositories and sensitive data stored on the affected server are at risk of complete compromise (Gogs Advisory, GitHub Advisory).

A public proof-of-concept exploit is included in the official security advisory and has also been indexed on Sploitus, making weaponization straightforward (Gogs Advisory). The EPSS score is approximately 0.27% (51st percentile), and no confirmed in-the-wild exploitation or threat actor attribution has been reported as of the time of disclosure. The vulnerability is not currently listed in the CISA KEV catalog. The attack requires no privileges and no user interaction, making it highly accessible to opportunistic attackers (GitHub Advisory).

1. Reconnaissance: Identify internet-facing Gogs instances running version 0.13.3 or earlier using tools like Shodan or Censys, searching for Gogs web interfaces.
2. Obtain API access: Register or use an existing account on the target Gogs instance to obtain a valid API token (self-service accounts suffice).
3. Create a symlink and push to repository: In a local clone of a repository on the target, create a symlink pointing to .git/config: ln -s .git/config link && git add link && git commit -m 'add' && git push.
4. Craft malicious .git/config content: Prepare a base64-encoded .git/config payload containing a malicious sshCommand directive (e.g., sshCommand = touch /tmp/pwned) that will execute an arbitrary OS command when Git performs an SSH operation.
5. Overwrite .git/config via API: Send a PUT request to /api/v1/repos/{owner}/{repo}/contents/link with the malicious base64-encoded content, exploiting the missing security check in the API router to write the payload through the symlink to .git/config.
6. Trigger command execution: Initiate a Git SSH operation (e.g., a fetch or push) on the server that causes Git to read the modified .git/config, executing the injected sshCommand as the Gogs service account (Gogs Advisory, GitHub Advisory).

• Network: Unexpected PUT requests to /api/v1/repos/{owner}/{repo}/contents/ endpoints, especially for paths resolving to symlinks; outbound connections from the Gogs server to unknown external IPs following Git SSH operations.
• File System: Presence of symlink files in repository working directories pointing to .git/config or other .git/ directory files; unexpected modification timestamps on .git/config files; new or modified files in /tmp/ or other world-writable directories created by the Gogs service account.
• Logs: Gogs access logs showing PUT /api/v1/repos/*/contents/* requests with base64-encoded content payloads; Git operation logs showing unexpected sshCommand execution; authentication logs showing API token usage from unfamiliar IP addresses.
• Process: Unusual child processes spawned by the Gogs or Git process (e.g., bash, sh, curl, wget, python) that are not part of normal Git operations (Gogs Advisory).

Gogs has released patched versions 0.13.4 and 0.14.0+dev, which address the insufficient fix from CVE-2024-56731. Organizations should immediately upgrade all Gogs instances running version 0.13.3 or earlier to version 0.13.4 or later. No configuration-based workaround has been published; upgrading is the only recommended remediation. Administrators should also audit API access logs for signs of exploitation prior to patching (Gogs Advisory, GitHub Advisory).

Security media outlets including SecurityOnline, CyberPress, and UnderCodeNews covered the vulnerability, highlighting it as part of a "triple threat" of critical Gogs flaws enabling RCE and 2FA bypass (SecurityOnline, CyberPress, UnderCodeNews). The BeyondMachines community flagged the vulnerability on Mastodon and dev.to, emphasizing the risk of unauthenticated RCE and the availability of a PoC. The CVE was also listed among the top 10 trending CVEs on Reddit's CVEWatch community shortly after disclosure.