Remote Command Execution Vulnerability in Gogs by Gogs
CVE-2025-64111

9.3CRITICAL

Key Information:

Vendor

Gogs

Status
Gogs
Vendor
CVE Published:
6 February 2026

What is CVE-2025-64111?

Gogs, an open-source self-hosted Git service, has a serious vulnerability that allows attackers to update files within the .git directory, potentially leading to remote command execution. This issue arises due to inadequate mitigation of a previous vulnerability, CVE-2024-56731. Users must upgrade to Gogs versions 0.13.4 or 0.14.0+dev to ensure their systems are secure from exploitation. Maintaining software updates is essential for safeguarding your infrastructure against potential attacks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

gogs < 0.14.0+dev < 0.14.0+dev

gogs < 0.13.4 < 0.13.4

References

https://github.com/gogs/gogs/security/advisories/GHSA-gg6...
x_refsource_CONFIRM

CVSS V4

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.