{"id":"CVE-2025-64719","revision":null,"records":[{"revision":"99536993adf847109f29731c84758ee9","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-64719","aliases":[],"title":"Gogs: Denial of Service in repository/wiki file listing web pages","description":"Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki. The issue is present in file internal/route/repo/wiki.go and internal/route/repo/view.go where the pages try to recover commit information. If errors are returned while recovering commit information, the page will return a 500 error and stop rendering, resulting in a denial of service. This vulnerability is fixed in 0.14.3.","state":0,"publishedAt":"2026-06-24T20:03:07.239+00:00","modifiedAt":"2026-06-25T20:05:56.25+00:00","affected":[{"ecosystem":"Vendor product","name":"gogs","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"gogs\",\n                    \"product\": \"gogs\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 0.14.3\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","score":4.9,"severity":"MEDIUM"}],"references":["https://github.com/gogs/gogs/security/advisories/GHSA-3qq3-668m-v9mj"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-64719","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-64719","identifiers":["CVE-2025-64719"]},"retained":false,"historicalAffected":[]},{"revision":"9711e3d085a442d2a3bd4bd52771fe95","observedAt":"2026-11-09T04:07:32.498+00:00","statement":{"source":"euvd","id":"EUVD-2025-210329","aliases":["CVE-2025-64719","GHSA-3qq3-668m-v9mj"],"title":"Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files wil…","description":"Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki. The issue is present in file internal/route/repo/wiki.go and internal/route/repo/view.go where the pages try to recover commit information. If errors are returned while recovering commit information, the page will return a 500 error and stop rendering, resulting in a denial of service. This vulnerability is fixed in 0.14.3.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","score":4.9,"severity":null}],"references":["https://github.com/gogs/gogs/security/advisories/GHSA-3qq3-668m-v9mj"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-210329","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jun 24, 2026, 8:03:07 PM","dateUpdated":"Jun 25, 2026, 8:05:56 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-210329","identifiers":["EUVD-2025-210329","CVE-2025-64719","GHSA-3qq3-668m-v9mj"]},"retained":false,"historicalAffected":[]},{"revision":"d193230b32a844ffa5e7eee4a6ad2a68","observedAt":"2026-10-25T03:17:29.935+00:00","statement":{"source":"nvd","id":"CVE-2025-64719","aliases":[],"title":"Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files wil…","description":"Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki. The issue is present in file internal/route/repo/wiki.go and internal/route/repo/view.go where the pages try to recover commit information. If errors are returned while recovering commit information, the page will return a 500 error and stop rendering, resulting in a denial of service. This vulnerability is fixed in 0.14.3.","state":0,"publishedAt":"2026-06-24T21:16:52.007+00:00","modifiedAt":"2026-10-12T21:10:00.227+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","score":4.9,"severity":"MEDIUM"}],"references":["https://github.com/gogs/gogs/security/advisories/GHSA-3qq3-668m-v9mj"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-64719","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-20"],"productCriteria":[],"sourceDates":{"published":"2026-06-24T21:16:52.007","lastModified":"2026-10-12T21:10:00.227"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-64719","identifiers":["CVE-2025-64719"]},"retained":false,"historicalAffected":[]},{"revision":"d70eba8f640747ca997894699e9a6994","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-3qq3-668m-v9mj","aliases":["CVE-2025-64719","GO-2026-5098"],"title":"Gogs has a Denial of Service in repository/wiki file listing web pages","description":"### Summary\nA malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository or wiki.\n\n### Details\nThe issue is present in file `internal/route/repo/wiki.go` and `internal/route/repo/view.go` where the pages try to recover commit information. If errors are returned while recovering commit information, the page will return a 500 error and stop rendering, resulting in a denial of service.\nIn `view.go` the issue occurs at [line 56](https://github.com/gogs/gogs/blob/89f0f86c7e1a3be7f48d99e27818a79d17357558/internal/route/repo/view.go#L56) while a slightly different issue occurs in `wiki.go` at [line 174](https://github.com/gogs/gogs/blob/89f0f86c7e1a3be7f48d99e27818a79d17357558/internal/route/repo/wiki.go#L174) where `commits[0]` is dereferenced without checking if it contains value.\nIt is possible to trigger issues in assigning the correct value to variable `commits` by using a specific string as part of the page title. \nThe issue is linked to the fact that file names can contain special characters such as `*`, `?`, `[`, `]`, etc. that will be interpreted as git's pathspec instead of a simple string. So crafting a name containing an incomplete pathspec sequence will trigger this error.\n\n### PoC\nAs a proof of concept consider the file name `\"[]` and how it affects repository and wiki pages.\nIn the following images it is shown how pages are created, the error shown in the web page right after creation and the error as logged in the console.\n\n<img width=\"835\" height=\"503\" alt=\"repo_creation\" src=\"https://github.com/user-attachments/assets/cdee9625-33d9-42d3-a5fa-264fba4923ed\" />\n\n**Figure 1: Creation of malicious file in repository**\n\n<img width=\"832\" height=\"692\" alt=\"repo_error_web\" src=\"https://github.com/user-attachments/assets/53c57366-8f45-4a0f-a2ac-86f4a08467cc\" />\n\n**Figure 2: Malicious file in repository causes error 500**\n\n<img width=\"934\" height=\"56\" alt=\"repo_error_console\" src=\"https://github.com/user-attachments/assets/26427fc3-bead-4e41-a484-e2d53289a2da\" />\n\n**Figure 3: Console error caused by malicious file in repository**\n\n<img width=\"835\" height=\"503\" alt=\"wiki_creation\" src=\"https://github.com/user-attachments/assets/7a5c9836-64e3-4824-b6e5-9f9a80e7f18a\" />\n\n**Figure 4: Creation of malicious file in wiki**\n\n<img width=\"1001\" height=\"463\" alt=\"wiki_error_web\" src=\"https://github.com/user-attachments/assets/33c5a907-b81c-4157-bd37-33341412172a\" />\n\n**Figure 5: Malicious file in wiki causes error 500**\n\n<img width=\"1018\" height=\"537\" alt=\"wiki_error_console\" src=\"https://github.com/user-attachments/assets/9b0ab551-5720-4715-a2ac-f7310534f025\" />\n\n**Figure 6: Console error caused by malicious file in wiki**\n\n### Impact\nThe repository and wiki pages will not render when files named with the payload are present in the repository or in the wiki.\nThis condition will be present as long as the malicious file is present in the repository or wiki. The issue will not cause a DoS condition when using the server via CLI.","state":0,"publishedAt":"2026-06-22T16:58:31+00:00","modifiedAt":"2026-07-21T13:30:31.7403134+00:00","affected":[{"ecosystem":"Go","name":"gogs.io/gogs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"0.14.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/gogs/gogs/security/advisories/GHSA-3qq3-668m-v9mj","https://nvd.nist.gov/vuln/detail/CVE-2025-64719","https://github.com/gogs/gogs/pull/8116","https://github.com/gogs/gogs/commit/ae41bab5f28e4880edcef01c91d2cbb8839ec9e4","https://github.com/gogs/gogs","https://github.com/gogs/gogs/releases/tag/v0.14.3"],"sourceUrl":"https://github.com/advisories/GHSA-3qq3-668m-v9mj","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-3qq3-668m-v9mj","identifiers":["GHSA-3qq3-668m-v9mj","CVE-2025-64719","GO-2026-5098"]},"retained":false,"historicalAffected":[]},{"revision":"36600381ff7e486f966309d4cff608fb","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-5098","aliases":["CVE-2025-64719","GHSA-3qq3-668m-v9mj"],"title":"Gogs has a Denial of Service in repository/wiki file listing web pages in gogs.io/gogs","description":"Gogs has a Denial of Service in repository/wiki file listing web pages in gogs.io/gogs.\n\nNOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.\n\n(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)\n\nThe additional affected modules and versions are: gogs.io/gogs before v0.14.3.","state":0,"publishedAt":"2026-06-25T18:26:48+00:00","modifiedAt":"2026-06-25T18:45:19.5281315+00:00","affected":[{"ecosystem":"Go","name":"gogs.io/gogs","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gogs/gogs/security/advisories/GHSA-3qq3-668m-v9mj","https://github.com/gogs/gogs/commit/ae41bab5f28e4880edcef01c91d2cbb8839ec9e4","https://github.com/gogs/gogs/pull/8116","https://github.com/gogs/gogs/releases/tag/v0.14.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-5098","license":"OSV · upstream source license applies","key":"osv:GO-2026-5098","identifiers":["GO-2026-5098","CVE-2025-64719","GHSA-3qq3-668m-v9mj"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T09:21:39.5670180+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T09:21:39.567018+00:00","lastSuccessAt":"2026-11-10T09:21:39.7230126+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.7230148+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-8bdcdeeb414e06ff50ed637d818ac25d52680d19f71fc0ebe3f4c4b3f836ed38","complete":true,"records":421927,"lastAttemptAt":"2026-11-10T09:21:38.2251552+00:00","lastSuccessAt":"2026-11-10T09:21:38.1064889+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:38.2251552+00:00","snapshotPublishedAt":"2026-11-10T09:20:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T09:22:06.7603645+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T09:21:39.5670180+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T09:21:39.567018+00:00","lastSuccessAt":"2026-11-10T09:21:39.7239823+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.7239826+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-31ba7927d759462ab5120f3eef3ca629","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T09:22:06.1277445+00:00","lastSuccessAt":"2026-11-10T09:22:06.124+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T09:22:06.124+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T09:21:39.3678777+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.3678777+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T09:21:39.1274719+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.1274719+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T09:21:39.5260038+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.5260038+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4331051b0b2d4ccdbdca3aa196b0be3818a465064a4b18dde4cf39c2250eb490","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T09:21:39.251251+00:00","lastSuccessAt":"2026-11-10T08:04:37.1757322+00:00","error":null,"lastVerifiedAt":"2026-11-10T09:21:39.251251+00:00","snapshotPublishedAt":"2026-11-10T07:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}