4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-64719

CVE-2025-64719: Gogs: Denial of Service in repository/wiki file listing web pages

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki. The issue is present in file internal/route/repo/wiki.go and internal/route/repo/view.go where the pages try to recover commit information. If errors are returned while recovering commit information, the page will return a 500 error and stop rendering, resulting in a denial of service. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-64719

CVE-2025-64719:

4.9

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	<= 0.14.2	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial of service in Gogs caused by improper input validation of file and wiki page names. When a user creates a file or wiki page with a name containing special characters that have meaning in git's pathspec syntax (e.g., [], *), the application fails to handle them correctly. The functions responsible for listing files in a repository or pages in a wiki would pass these names to the underlying git command without sanitization. The git command would interpret the special characters, fail to find a matching path, and return an error. This error was not properly handled in the application, leading to a panic or an unhandled error, which in turn caused the web server to return an HTTP 500 error. This rendered the file listing pages for the repository or wiki inaccessible, effectively causing a denial of service for that part of the application. The patch addresses this by consistently using the git.LsTreeOptions{Verbatim: true} option, which instructs the git command to treat the pathspecs literally and not interpret any special characters, thus preventing the error.

Vulnerable functions

renderDirectory

internal/route/repo/view.go

The function `renderDirectory` was vulnerable to a denial of service. It did not properly sanitize user-provided filenames when listing directory contents. A malicious actor could create a file with special characters in its name (e.g., '[]'), which would be interpreted as a git pathspec. This would cause the underlying `tree.Entries()` call to fail, resulting in an unhandled error and an HTTP 500 response, making the repository's file browser unusable.

renderWikiPage

internal/route/repo/wiki.go

The function `renderWikiPage` was vulnerable to a denial of service. It did not properly sanitize wiki page titles when listing other pages. A malicious actor could create a wiki page with special characters in its title (e.g., '[]'), which would be interpreted as a git pathspec. This would cause the underlying `commit.Entries()` call to fail, resulting in an unhandled error and an HTTP 500 response, making the wiki page and its sidebar listing unusable.

WikiPages

internal/route/repo/wiki.go

The function `WikiPages` was vulnerable to a denial of service. It did not properly sanitize wiki page titles when listing all pages. A malicious actor could create a wiki page with special characters in its title (e.g., '[]'), which would be interpreted as a git pathspec. This would cause the underlying `commit.Entries()` call to fail, resulting in an unhandled error and an HTTP 500 response, making the wiki's page listing unusable.

GetContents

internal/route/api/v1/repo/contents.go

The API endpoint `GetContents` was vulnerable to a denial of service. It did not properly sanitize filenames when listing directory contents via the API. A malicious actor could create a file with special characters in its name, causing the `gitRepo.LsTree()` and subsequent `dir.Entries()` calls to fail, leading to an API error and denial of service for that endpoint.

GetRepoGitTree

internal/route/api/v1/repo/tree.go

The API endpoint `GetRepoGitTree` was vulnerable to a denial of service. It did not properly sanitize filenames when retrieving a git tree. If a file with special characters in its name existed in the tree, the `gitRepo.LsTree()` and subsequent `tree.Entries()` calls would fail, leading to an API error and denial of service for that endpoint.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.