New Gogs zero-day flaw lets hackers get remote code execution
A zero-day in Gogs can let authenticated attackers get remote code execution on exposed servers. Default settings can make the flaw reachable with a newly created account.
Intelligence analysis by GPT-5.4 Mini
BleepingComputer reports an unpatched Gogs argument-injection flaw in the self-hosted Git service that can lead to remote code execution on internet-facing instances. The article says default open-registration settings can make exploitation possible even without admin access.
Gogs is a tool people use to keep code online and share it. A new bug can let a bad person trick the server into running their own commands.
It is a bit like slipping a fake note into a recipe so the kitchen starts doing the wrong thing. If the server follows that bad note, the attacker can take over parts of the machine.
The danger is not just one project. The attacker could also peek at private code, stolen passwords, and keys that open other systems.
Analysis
What happened
BleepingComputer says an unpatched zero-day in Gogs, the self-hosted Git service, can be used for remote code execution on internet-facing instances. The flaw affects Gogs 0.14.2 and 0.15.0+dev and has not yet been assigned a CVE.
How it works
According to Rapid7 researcher Jonah Burgess, the issue is an argument-injection bug that can be triggered by authenticated users without admin privileges. The exploit path uses a malicious branch name to inject the --exec flag into git rebase during the “Rebase before merging” workflow. The article notes that on default-configured systems, open registration and unlimited repository creation can let an unauthenticated attacker create an account, make a repo, and then continue the chain.
Why it is dangerous
Successful exploitation can run arbitrary code as the Gogs server process user. The article says attackers could compromise the server, read repositories including private ones, dump credentials such as password hashes, API tokens, SSH keys, and 2FA secrets, pivot to other systems, and alter hosted code.
Vendor response and exposure
Burgess reported the issue to Gogs maintainers on March 17, and the article says they acknowledged it on March 28 but had not provided a patch or further update at publication time. Shadowserver is tracking more than 2,400 exposed Gogs servers, with most in Asia and Europe, while Shodan found just over 1,000 IPs with a Gogs fingerprint.
The article also places this bug in context with earlier Gogs argument-injection flaws, including CVE-2025-8110, which had been exploited in zero-day attacks before being patched.
Key points
- A zero-day in Gogs can lead to remote code execution on exposed servers.
- The flaw affects Gogs 0.14.2 and 0.15.0+dev and has no CVE yet.
- Rapid7 says default settings can let an attacker create an account and repo, then exploit the bug.
- The attack abuses a malicious branch name during the rebase-before-merging flow.
- The article says the bug can expose private repos, secrets, and other systems.
- Gogs maintainers had acknowledged the report but had not shipped a patch at publication time.
