CVE-2025-64111 is a critical command execution flaw in the Gogs self-hosted Git service, scored CVSS 9.8. It is an incomplete fix for CVE-2024-56731, and files in the .git directory could still be updated through the API. Upgrade Gogs to 0.13.4 or later.
What's affected
The GitHub advisory says Gogs 0.13.3 and earlier are affected. Patched versions are 0.13.4 and 0.14.0+dev. The advisory was published on 6 February 2026 for the Go module gogs.io/gogs. The weakness is tagged CWE-78, OS command injection.
The cause, per the advisory, is that an earlier patch was incomplete. The earlier fix added a security check inside the function that updates repository files, but the check applies only under certain conditions. A call made through the repository contents API did not meet those conditions, so it was still possible to change files inside the repository's .git directory. The advisory names the route as the repository put contents API.
How to check if you're exposed
Find the version of every Gogs server you run, including test and internal copies.
gogs --version
The version is also shown in the footer of the web interface for most installs. If you run it from a container image, read the image tag and check what is actually running, not just what your compose file says.
If the version is 0.13.3 or lower, you are affected. Next, ask who can reach the API. The advisory shows that an API token and a repository to write to are involved, so anyone who can create an account and a repository on an open instance is in the risk group. A server that allows public sign up deserves the most urgency.
Review recent activity too. Look at the access log for calls to the contents API from accounts you do not recognise, and at repositories for changes you cannot explain.
What to do now
- Upgrade Gogs to 0.13.4 or later. For a build from the development branch, use 0.14.0+dev or later.
- Disable open registration if you do not need it, so only known users can make accounts and tokens.
- Revoke API tokens that are old or unknown and ask users to create new ones.
- Put the Gogs web interface behind a VPN or an identity aware proxy where you can.
- Run Gogs as an unprivileged user in a container or service with limited file and network access, so command execution has little to reach.
- Check the server for unexpected changes to repository configuration files and for processes started by the Gogs user that you do not expect.
- Keep a patch watch on Gogs, since this is the second report in a row on the same area.
Why it matters
The class is CWE-78, OS command injection. Git reads configuration from the .git directory, and some of that configuration can name programs to run. If an attacker can write to that directory, Git itself may run something on the server the next time it handles the repository. That is why a file update bug turns into code execution.
The story here is as useful as the flaw. A fix put a check in one function, and one entry point did not pass through it. The pattern shows up often: a rule is enforced where it was first noticed, not at the point where the dangerous action happens. A more durable fix puts the rule at the lowest layer, so that every route, API, web form and background job, goes through it.
Self hosted Git servers hold source code and often credentials in repositories, and they can sit on trusted networks. That makes them attractive and their patches worth tracking. The KEV flag is false, and the advisory does not say the issue is exploited in the wild.
If you use Gogs only inside a small trusted team, the practical risk is lower, but a token from any one developer could be enough. Reviewing who holds tokens is cheap.
Quick check
Why is this called an incomplete fix?
The advisory says an earlier patch added a check that did not apply to the repository contents API, so the same kind of attack stayed possible through that route.
Is Gogs 0.14 released?
The advisory lists 0.14.0+dev as patched, which is a development version. Use 0.13.4 for a stable release.
Sources
Last reviewed: 19 October 2026.
