Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use any unused recovery code (e.g., from their own account) to bypass the victim’s 2FA. This enables full account takeover and renders 2FA ineffective in all environments where it's enabled.. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

Gogs <= 0.13.3 Multiple Vulnerabilities

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code
    validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s
    username and password, they can use any unused recovery code (e.g., from their own account) to bypass the
    victim’s 2FA. This enables full account takeover and renders 2FA ineffective in all environments where
    it's enabled.. This issue has been patched in versions 0.13.4 and 0.14.0+dev. (CVE-2025-64175)

According to its self-reported version, the instance of Gogs running on the remote host is prior or equal to 0.13.3.
It is, therefore, affected by multiple vulnerabilities, including:

  - Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. (CVE-2025-8110)

  - Due to the insufficient patch for CVE-2024-56731, it is still possible to update files in the .git directory and     achieve remote command execution. (CVE-2025-64111)

  - An arbitrary file read/write via path traversal exists in Git hook editing. (CVE-2026-23633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
437616	SCA: security update for gogs.io/gogs (GHSA-p6x6-9mx6-26wj)	Tenable Cloud Security	SCA Checks	high
437616	SCA: security update for gogs.io/gogs (GHSA-p6x6-9mx6-26wj)	Tenable Self-Hosted Container Security	SCA Checks	high
286268	Gogs <= 0.13.3 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2025-64175

high

Tenable Plugins

Coming Soon

high

high

critical