Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M
CVE-2025-64719Gogs: Denial of Service in repository/wiki file listing web pages
Medium 4.9
In plain English
A medium-severity improper input validation in gogs from gogs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki. The issue is present in file internal/route/repo/wiki.go and internal/route/repo/view.go where the pages try to recover commit information. If errors are returned while recovering commit information, the page will return a 500 error and stop rendering, resulting in a denial of service. This vulnerability is fixed in 0.14.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | gogs.io/gogs | 0.14.3 | GHSA-3qq3-668m-v9mj |
| Go | gogs.io/gogs | no fix listed | GO-2026-5098 |
Affected products (as reported)
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
References
- https://github.com/gogs/gogs/security/advisories/GHSA-3qq3-668m-v9mj x_refsource_CONFIRM