CRITICAL🇵🇱 Wersja polska

CVE-2025-64111

CVSS 9.3v4.0pub. 2026-02-06upd. 2026-02-18

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command execution. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

🇵🇱 Read Polish description →

🤖 AI Analysis

How it works

The patch applied in the previous version for CVE-2024-56731 proved insufficient — an attacker can still manipulate files in the .git directory of repositories hosted by Gogs. By deliberately overwriting or creating Git configuration files, it is possible to trigger the execution of arbitrary system commands (command injection, CWE-78) on the server side. The attack requires no authentication or user interaction.

Impact

An attacker can remotely execute arbitrary commands on the server hosting Gogs, leading to full system takeover, theft of repository data, and potential lateral movement within the internal network.

Mitigation & patch

Gogs should be updated to version 0.13.4 or 0.14.0+dev, in which the vulnerability has been fixed. Patches are available in the official project repository on GitHub.

Who is affected

Gogs version 0.13.3 and all earlier versions

Analysis generated by Claude AI (Anthropic) based on NVD data. Always verify with vendor.

CVSS Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X