CVE-2025-64111

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.4

Description An OS command injection exists due to an insufficient patch for a previous issue. An attacker can abuse a symlink and the repository contents API to update files within the .git directory, specifically overwriting the .git/config file. By injecting malicious Git configurations, such as the sshCommand variable, remote command execution is achieved during Git operations. The issue occurs because the security check in the UpdateRepoFile() function is bypassed when called via the API router. The affected API endpoint is /api/v1/repos/{owner}/{repo}/contents/{file path}.

Recommendations Update Gogs to version 0.13.4 or 0.14.0+dev.