Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only on the leaf of the upload target (osx.IsSymlink(targetPath)). The siblings UpdateRepoFile, DeleteRepoFile, and GetDiffPreview use hasSymlinkInPath, which lstats every component — UploadRepoFiles is the lone outlier. An attacker with repo-write access plus a multipart upload whose filename contains a literal backslash (preserved by filepath.Base on Linux, then converted to / by pathx.Clean) redirects the write through a previously-committed directory symlink. iox.CopyFile opens the destination with os.Create (no O_NOFOLLOW), so the kernel follows the parent symlink and writes attacker bytes anywhere the gogs UID can write — ~git/.ssh/authorized_keys → SSH foothold, or <repo>.git/hooks/post-receive → next-push RCE. This vulnerability is fixed in 0.14.3.
The UploadRepoFiles function checks for symlinks only in the last element of the target path (leaf), in contrast to UpdateRepoFile, DeleteRepoFile, and GetDiffPreview functions, which verify each path component. The attacker uploads a multipart file whose name contains a literal backslash character — on Linux, filepath.Base preserves it, and then pathx.Clean converts it to a directory separator (/), which redirects the write through a previously committed directory symlink in the repository. The iox.CopyFile function opens the target file via os.Create without the O_NOFOLLOW flag, so the kernel follows the symlink and writes the attacker's data anywhere accessible to the Gogs process UID. Example exploitation scenarios include overwriting the ~/.ssh/authorized_keys file (obtaining SSH access) or Git hook files (e.g., post-receive), leading to RCE on the next push to the repository.
An attacker can write arbitrary content to files accessible by the Gogs system account, which in practice enables obtaining persistent SSH access to the server or remote code execution (RCE) via a malicious Git hook.
Update Gogs to version 0.14.3 or later. A patch is available in the official project repository (tag v0.14.3). As a temporary measure, restrict write access to repositories only to trusted users.
Gogs in versions earlier than 0.14.3
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X