Executive brief
Gogs is an open-source service used by teams to host and manage Git repositories and wikis. A vulnerability allows a user with file-creation permissions to crash specific repository or wiki pages by using specially crafted filenames. This results in a denial-of-service where the web interface becomes unusable for that specific project, potentially disrupting development workflows and access to documentation.
Technical details
A denial-of-service vulnerability exists in Gogs due to improper input validation of filenames in the repository and wiki viewing components. The issue resides in 'internal/route/repo/wiki.go' and 'internal/route/repo/view.go', where the application fails to properly handle Git pathspec characters (such as '*', '?', '[', ']') in filenames. When a file with an incomplete or malformed pathspec sequence (e.g., '[]') is created, the backend fails to recover commit information and returns an unhandled 500 error. An attacker with high privileges (write access) can exploit this to make the web interface for a repository or wiki inaccessible. The vulnerability is fixed in version 0.14.3.
Affected products
- Gogs Gogs < 0.14.3
Timeline
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD