Critical Gogs Vulnerabilities Enable Remote Code Execution and 2FA Bypass

#cybersecurity #infosec

Summary

Gogs released security updates to address a critical RCE vulnerability (CVE-2025-64111) and a 2FA bypass (CVE-2025-64175) affecting self-hosted Git instances. These flaws allow authenticated attackers to execute system commands via malicious Git configurations or take over user accounts by misusing recovery codes.

Take Action:

If you are using self-hosted Gogs, this is important - especially if your Gogs is publicly accessible and free to register. Update to version 0.13.4. If you cannot patch right away, restrict network access to your Git service and ensure only trusted users can register and push code.

Read the full article on BeyondMachines

This article was originally published on BeyondMachines