The vulnerability in Gogs occurs when editing Git hook files, allowing an attacker to use directory traversal characters to read or write files anywhere on the host. This results in the ability to access sensitive configuration files, credentials, or to alter executable hook scripts, potentially leading to broader compromise of the system. The weakness is a classic path traversal flaw (CWE‑22).

The CVE affects the open source Gogs self‑hosted Git service, specifically versions 0.13.3 and earlier. The issue has been addressed in version 0.13.4 and all subsequent releases, including 0.14.0 and later development builds. Systems running the vulnerable branches should be notified of the need to upgrade.

The CVSS score of 6.5 indicates a medium severity, while the EPSS score is reported as less than 1 %, suggesting a very low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through the web interface while editing Git hooks, enabling a remote authenticated user to inject traversal sequences and manipulate files outside the repository. If an attacker gains the necessary permissions, the impact can be significant, but the low exploitation likelihood and absence from KEV mitigate immediate threat concerns.