A new unpatched zero-day vulnerability in the Gogs self-hosted Git service can let attackers remotely execute code on exposed servers.
Gogs is a Git platform written in Go and is often used as a self-hosted alternative to GitHub Enterprise or GitLab for remote software collaboration.
The critical flaw is an argument injection vulnerability and has not yet received a CVE ID. It affects the latest Gogs versions, including 0.14.2 and 0.15.0+dev. While attackers need an authenticated account to exploit it, they do not need admin privileges.
Rapid7 senior security researcher Jonah Burgess, who discovered the issue, warned that the flaw affects Gogs servers running with default settings. That is because Gogs enables open registration by default and does not limit repository creation. As a result, an attacker can simply create an account, make a repository, and use it to carry out the exploit chain.
Once the attacker owns a repository, they can enable rebase merging in the settings and then abuse a malicious branch name inside a pull request. This allows them to inject the --exec flag into the Git rebase process during the “Rebase before merging” operation.
If successfully exploited, the vulnerability allows attackers to run arbitrary code as the Gogs server process user. From there, they could compromise the server, read private repositories, steal credentials such as password hashes, API tokens, SSH keys, and 2FA secrets, move deeper into the network, or modify hosted source code.
Burgess said the bug is similar to other argument injection flaws patched by Gogs in recent years, but this one affects a different code path that had not been fixed. He reported the vulnerability to Gogs maintainers on March 17. The maintainers acknowledged the report on March 28, but have not yet released a patch or responded to later status requests.
Shadowserver is currently tracking more than 2,400 Gogs servers exposed online, with most located in Asia and Europe. Shodan has also found just over 1,000 IP addresses showing a Gogs fingerprint.
This is not the first time Gogs has faced serious security problems. In early December, the project patched another RCE vulnerability, tracked as CVE-2025-8110, which had already been exploited as a zero-day to compromise hundreds of servers.
Wiz researchers, who reported that earlier flaw, said many exposed Gogs instances had open registration enabled by default, creating a large attack surface. CISA later confirmed that CVE-2025-8110 was being actively exploited and added it to its known exploited vulnerabilities catalog, ordering U.S. federal agencies to secure affected servers by February 2.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
