9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64111

CVE-2025-64111: Gogs's update .git/config file allows remote command execution

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command execution. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64111

CVE-2025-64111:

9.3

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	<= 0.13.3	0.13.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the insufficient handling of symbolic links (symlinks) when updating repository files through the Gogs API. An attacker could create a repository containing a symlink that points to a sensitive file on the server, such as the .git/config file of another repository. By using the API to modify the content of this symlink, the attacker could overwrite the target file, leading to remote code execution (RCE). The sshCommand directive in a .git/config file can be used to execute arbitrary commands on the server during Git operations.

The patch for this vulnerability, found in commit c3eca1fca3a4750e55dfa6d9935564a897232858, introduces a new function hasSymlinkInPath that recursively checks for symlinks in a given path. This check is then applied in the UpdateRepoFile, GetDiffPreview, and DeleteRepoFile functions within internal/db/repo_editor.go to reject any operation on a path that contains a symlink. This prevents the path traversal vulnerability and stops the attacker from modifying files outside the intended repository directory.

Vulnerable functions

db.Repository.UpdateRepoFile

internal/db/repo_editor.go

This function was vulnerable to a path traversal attack using symlinks. An attacker could create a symlink to a sensitive file like `.git/config` and then use the API to modify it, leading to remote code execution. The function did not properly validate the file path to prevent the use of symlinks.

db.Repository.GetDiffPreview

internal/db/repo_editor.go

Similar to `UpdateRepoFile`, this function was also vulnerable to path traversal via symlinks. An attacker could have used this function to get a diff of a sensitive file by creating a symlink to it.

db.Repository.DeleteRepoFile

internal/db/repo_editor.go

This function was also vulnerable to path traversal via symlinks. An attacker could have used this function to delete a sensitive file by creating a symlink to it.

repo.UpdateContents

internal/route/api/v1/repo/contents.go

This function is the API endpoint that receives the malicious request. It takes the user-provided file path and passes it to the vulnerable `db.Repository.UpdateRepoFile` function. While not the root cause, this function would appear in the call stack during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.