Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command execution. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

Gogs <= 0.13.3 Multiple Vulnerabilities

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch
    for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command
    execution. This issue has been patched in versions 0.13.4 and 0.14.0+dev. (CVE-2025-64111)

According to its self-reported version, the instance of Gogs running on the remote host is prior or equal to 0.13.3.
It is, therefore, affected by multiple vulnerabilities, including:

  - Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. (CVE-2025-8110)

  - Due to the insufficient patch for CVE-2024-56731, it is still possible to update files in the .git directory and     achieve remote command execution. (CVE-2025-64111)

  - An arbitrary file read/write via path traversal exists in Git hook editing. (CVE-2026-23633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
437617	SCA: security update for gogs.io/gogs (GHSA-gg64-xxr9-qhjp)	Tenable Cloud Security	SCA Checks	critical
437617	SCA: security update for gogs.io/gogs (GHSA-gg64-xxr9-qhjp)	Tenable Self-Hosted Container Security	SCA Checks	critical
286268	Gogs <= 0.13.3 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-64111

critical

Tenable Plugins

Coming Soon

critical

critical

critical