Loading vulnerability…
Denial of Service in Gogs repository and wiki listing pages
CVE-2025-64719 is a denial-of-service vulnerability in Gogs affecting versions prior to 0.14.3 (including 0.14.2 and earlier). A malicious user with permission to create a new file in a repository or create a wiki entry can introduce a specially crafted filename that Git interprets as a malformed pathspec. The issue is present in internal/route/repo/wiki.go and internal/route/repo/view.go, where the application attempts to recover commit information for repository and wiki listings. If an error occurs during commit information recovery, the affected page returns HTTP 500 and stops rendering instead of handling the error safely. This can make repository index pages or wiki index pages persistently unavailable through the web interface while the malicious file remains present.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation causes persistent denial of service against the affected repository or wiki pages in the Gogs web interface. Repository file listing pages and wiki listing pages return HTTP 500 errors and become unusable for users attempting to browse them via the web UI. Based on the provided information, the impact is limited to availability of the web interface for the affected repository or wiki; CLI access is not affected, and there is no indication of code execution, privilege escalation, or data disclosure.
If you can’t patch tonight, do this now.
If immediate upgrade is not possible, restrict untrusted users' ability to create new files or wiki entries, monitor for suspicious filenames that may be interpreted by Git as malformed pathspecs, and remove offending files or wiki entries if exploitation occurs. These are temporary mitigations only; the definitive fix is upgrading to 0.14.3 or later.
Patch, then assume compromise.
Upgrade Gogs to version 0.14.3 or later, which fixes the error-handling flaw in repository and wiki page rendering related to commit information recovery.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.