CVE-2025-64111: Gogs Remote Command Execution via .git/config Update
Summary
CVE-2025-64111: Gogs's update .git/config file allows remote command execution. Affects gogs.io/gogs versions < 0.13.4. Fixed in 0.13.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service that allows users to manage their Git repositories with ease. It provides features such as repository management, issue tracking, and a user-friendly interface. However, a critical vulnerability has been identified that allows unauthorized updates to the .git/config file, potentially leading to remote command execution.
Vulnerability Detail
The vulnerability arises from an insufficient security check in the UpdateRepoFile function within Gogs. Under certain conditions, the API router can bypass these checks, allowing an attacker to update files in the .git directory. This flaw can be exploited to execute arbitrary commands on the server, leading to severe security implications.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.13.4
This is the first release that contains the fix.
go get gogs.io/gogs@v0.13.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the API router or implement additional security measures to prevent unauthorized file updates. However, the best solution is to update to the patched version.
Conclusion
The vulnerability CVE-2025-64111 in Gogs poses a significant risk due to its potential for remote command execution. Users are urged to update to the latest version to mitigate this risk. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for gogs.io/gogs →
FAQ
CVE-2025-64111 is a vulnerability in Gogs that allows remote command execution through unauthorized updates to the .git/config file.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
Exploitation of this vulnerability can lead to remote command execution, allowing attackers to execute arbitrary commands on the server, which can compromise the entire system.
Yes, a patch is available in version 0.13.4 of Gogs. Users are strongly advised to update to this version or later.
If immediate updating is not possible, consider implementing additional security measures to restrict access to the API router as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
