Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2025-64111 Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in … https://www.cve.org/CVERecord?id=CVE-2025-64111
Post summary
CVE‑2025‑64111 remains exploitable in Gogs 0.13.3 and earlier because the patch for CVE‑2024‑56731 is insufficient, allowing attackers to update files.
🚨 CVE-2025-64111: Gogs's update .git/config file a... Botched patch for Gogs (CVE-2024-56731) still lets attackers manipulate .git/config for RCE - trivial to exploit with z... https://zerodaysignal.com/vulnerability/CVE-2025-64111 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post announces CVE‑2025‑64111, highlighting that Gogs’s update to the .git/config file enables RCE, and references a botched patch for a prior CVE, without providing PoC or active exploitation details.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | gogs | gogs | - | - | - |