CVE-2025-64111 — OS Command Injection in Gogs

CWE-78 — OS Command Injection5 documents4 sources
Severity
9.3CRITICALNVD
EPSS
0.2%
top 54.22%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Gogs.io GogsGogs
Timeline
PublishedFeb 6
Latest updateFeb 17

Description

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command execution. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages2 packages

▶NVDgogs/gogs< 0.13.4
▶Gogogs.io/gogs< 0.13.4

🔴Vulnerability Details

3
OSV
Gogs's update .git/config file allows remote command execution in gogs.io/gogs↗2026-02-17
▶
GHSA
Gogs's update .git/config file allows remote command execution↗2026-02-06
▶
OSV
Gogs's update .git/config file allows remote command execution↗2026-02-06
▶

🕵️Threat Intelligence

1
Wiz
CVE-2025-64111 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶