CVE-2025-64719

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description A malicious user with permissions to create files in a repository or wiki page can trigger a denial of service. This occurs when pages containing file listings return an HTTP 500 error, rendering the web interface unusable for that repository or wiki. The issue resides in the files internal/route/repo/wiki.go and internal/route/repo/view.go during the recovery of commit information. Specifically, if a file name contains an incomplete pathspec sequence—using special characters like *, ?, [, or ]—it is interpreted as a git pathspec rather than a literal string. This leads to errors in assigning values to the commits variable, causing the page to stop rendering. In wiki.go, this manifests as a dereference of commits[0] without verifying if it contains a value.

Recommendations Update Gogs to version 0.14.3.