An unpatched zero-day vulnerability in the Gogs self-hosted Git service allows authenticated attackers to gain remote code execution on Internet-facing instances running default configurations. The flaw, a critical-severity argument injection vulnerability, affects Gogs versions 0.14.2 and 0.15.0+dev.

Exploitation requires only basic user credentials—no administrative privileges—and takes advantage of default settings that enable open registration and unlimited repository creation. "Since Gogs ships with open registration enabled by default (DISABLE_REGISTRATION = false) and no limit on repository creation (MAX_CREATION_LIMIT = -1), an unauthenticated attacker can simply create an account and repository on any default-configured instance," said Jonah Burgess, a senior security researcher.

Once registered, an attacker can create a repository and toggle the "Rebase before merging" option, enabling a code path that passes user-controlled input directly to a git rebase command. Successful exploitation allows remote execution of arbitrary code as the Gogs server process user via a malicious branch name that injects the --exec flag during pull request merges. "Any registered user who creates a repo is automatically its owner. From there, enabling rebase merging is a single toggle in settings, and the entire exploit chain can be operated without interaction from any other user," Burgess said.

The consequences extend beyond the compromised server. "They can abuse this security flaw to compromise the server, read every repository on the instance (including other users' private repos), dump credentials (password hashes, API tokens, SSH keys, 2FA secrets), pivot to other network-accessible systems, and modify any hosted repository's code."

Burgess reported the flaw to Gogs maintainers on March 17. The maintainers acknowledged the report on March 28 but have not issued a patch or responded to follow-up inquiries. The vulnerability has not been assigned a CVE ID as of the time of reporting and affects Gogs instances on Windows, Linux, and macOS.

Public scanning data indicates widespread exposure: Shadowserver tracks over 2,400 Gogs servers online, with Shodan identifying more than 1,000 IP addresses bearing a Gogs fingerprint. This marks the second Gogs zero-day disclosed in the past six months. In December, Gogs patched CVE-2025-8110—a different RCE flaw later confirmed by CISA to be actively exploited in the wild. "Many of these instances are configured with 'Open Registration' enabled by default, creating a massive attack surface," Wiz security researchers said. "This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," CISA warned. Rapid7 has released a Metasploit module that automates the full exploit chain for the new vulnerability, along with indicators of compromise to aid defenders in detecting potential intrusions.