CVE Intelligence
Analysis AI-assisted

CVE-2025-64111: Gogs OS command injection via .git directory file updates

Gogs versions 0.13.3 and earlier remain exposed to remote command execution because the earlier fix for CVE-2024-56731 was insufficient. The issue is classified as OS command injection (CWE-78) and rated critical, with an NVD CVSS 3.1 base score of 9.8. Upgrading to 0.13.4 or 0.14.0+dev is the main remedy, and the sources consulted show no confirmed active exploitation.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Gogs is an open source, self-hosted Git service. According to the record, versions 0.13.3 and earlier are affected by a flaw that remained after an insufficient patch for CVE-2024-56731. The flaw allows files in the .git directory to be updated, which can lead to remote command execution (CWE-78).

Impact

  • The record describes remote command execution, which would put the host running Gogs at risk.
  • The NVD base score is 9.8 under CVSS 3.1 (critical). GitHub lists 9.3 under CVSS 4.0.
  • The CVSS 3.1 vector rates confidentiality, integrity and availability impact as high.

Affected products and versions

  • Gogs Gogs versions before 0.13.4, which the record describes as 0.13.3 and prior.
  • Fixed in 0.13.4 and in 0.14.0+dev, according to the record description.
  • The structured fixes field in the record is empty, so the fixed versions are taken from the description.

Exploitation status

CISA KEV does not list this CVE. No confirmed active exploitation appears in the sources consulted. One reference in the record carries an Exploit tag, which describes the reference type and does not by itself confirm exploitation in the wild.

Remediation and mitigation

  • Upgrade Gogs to 0.13.4, or to 0.14.0+dev or later.
  • If an upgrade cannot be applied immediately, restrict access to the Gogs instance to trusted users and networks, and limit who can write to repositories.
  • Review the GitHub Security Advisory GHSA-gg64-xxr9-qhjp for vendor guidance.

Detection guidance

  • Monitor for unexpected modifications to files inside repository .git directories on Gogs servers.
  • Review recent repository write activity and server process activity for unexpected commands started by the Gogs service.

Limitations of the available information

  • The record does not provide a detailed technical analysis of the bypass of the CVE-2024-56731 fix.
  • EPSS and SSVC data are missing, so exploitation likelihood beyond KEV status is unknown.
  • The record does not state whether any public exploit code exists beyond the reference tag described above.

Frequently asked questions

Is this vulnerability being actively exploited?

CISA KEV does not list CVE-2025-64111, and no confirmed active exploitation appears in the sources consulted.

Which versions fix the issue?

According to the record description, the issue is patched in Gogs 0.13.4 and 0.14.0+dev.

How severe is this vulnerability?

NVD assigns a CVSS 3.1 base score of 9.8 (critical). GitHub lists a CVSS 4.0 score of 9.3.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.