Gogs Pathspec Flaw Lets Malicious Filenames Break Repository and Wiki Pages
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jun 21, 2026
Gogs disclosed a denial-of-service vulnerability, CVE-2025-64719, affecting gogs.io/gogs versions 0.14.2 and earlier. A malicious user with permission to create a new repository file or wiki entry can use a specially crafted filename containing Git pathspec-related characters to trigger persistent HTTP 500 errors on repository index and wiki listing pages. Public details in GitHub advisory GHSA-3qq3-668m-v9mj show a proof of concept using the filename:
[]
The flaw stems from commit information recovery logic in internal/route/repo/view.go and internal/route/repo/wiki.go, including a case where commits[0] may be dereferenced without confirming a valid value exists. The impact is limited to availability of the affected repository or wiki pages in the web interface; command-line Git operations are not affected, and the issue does not enable code execution or data theft. Gogs reported the bug was fixed in a release published on 2026-06-07, with public disclosure following on 2026-06-19.
