Quick answers
- Is CVE-2025-64719 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2025-64719 being exploited in the wild.
- How severe is CVE-2025-64719?
- Medium severity, with a CVSS score of 4.9, published 24 June 2026.
- Which products and versions are affected?
- gogs.io/gogs (Go) <= 0.14.2, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.14.3; Gogs < 0.14.3, <= 0.14.2.
- Is there a fix for CVE-2025-64719?
- Yes. gogs.io/gogs (Go): upgrade to 0.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2025-64719 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2025-64719?
- Check whether you run gogs.io/gogs (Go) or Gogs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- gogs.io/gogs (Go): upgrade to 0.14.3 or later
go get gogs.io/gogs@v0.14.3
Technical details
A denial-of-service vulnerability exists in Gogs due to improper input validation of filenames in the repository and wiki viewing components. The issue resides in 'internal/route/repo/wiki.go' and 'internal/route/repo/view.go', where the application fails to properly handle Git pathspec characters (such as '*', '?', '[', ']') in filenames. When a file with an incomplete or malformed pathspec sequence (e.g., '[]') is created, the backend fails to recover commit information and returns an unhandled 500 error. An attacker with high privileges (write access) can exploit this to make the web interface for a repository or wiki inaccessible. The vulnerability is fixed in version 0.14.3.
Affected products
- Gogs Gogs < 0.14.3
Identifiers
- CVE-2025-64719
- GHSA-3qq3-668m-v9mj
- GO-2026-5098
Timeline
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD