Unpatched Gogs Vulnerability Lets Authenticated Users Execute Remote Code

A critical zero‑day flaw in the self‑hosted Git service Gogs has been exposed, allowing attackers with only basic user privileges to run arbitrary code on Internet‑facing instances. The vulnerability, identified by Rapid7 researcher Jonah Burgess, exists in Gogs 0.14.2 and all 0.15.0‑plus releases. Because Gogs ships with open registration enabled by default (DISABLE_REGISTRATION = false) and no limit on repository creation (MAX_CREATION_LIMIT = -1), an unauthenticated attacker can create an account, own a repository, enable rebase merging, and trigger the exploit chain. During a rebase before merging, a malicious branch name injects the --exec flag into the git rebase command, giving the attacker remote code execution as the Gogs server process user.

The impact of the flaw is severe: an attacker can read every repository, dump credentials such as password hashes, API tokens, SSH keys, and two‑factor authentication secrets, pivot to other network‑accessible systems, and modify any hosted code. Shadowserver reports that more than 2,400 Gogs servers are exposed worldwide, with the majority located in Asia (1,894) and Europe (319). The vulnerability is similar to other argument‑injection flaws (CVE‑2024‑39933, CVE‑2024‑39932, CVE‑2026‑26194, CVE‑2024‑39930) but targets a different code path (Merge()) that had not been patched.

Gogs maintainers acknowledged the report on March 28 but have yet to release a patch, leaving many installations at risk. The discovery underscores the importance of timely patching and the potential consequences of default open registration settings in open‑source software.