Gogs, an open‑source self‑hosted Git platform, contains a flaw that allows anyone on the Internet to upload arbitrary files to certain directory endpoints. When the server’s RequireSigninView option is left disabled—the default setting—remote users can target /releases/attachments and /issues/attachments without authentication. The flaw provides a means for hostile actors to upload malicious payloads or large amounts of data, which can be used to host malware, exhaust disk space, or otherwise influence the instance’s integrity and availability. The issue is rooted in an access‑control weakness (CWE‑862), and it bypasses CSRF protection because the cookie is issued under the same origin.

The vulnerable versions are Gogs releases 0.13.4 and older. The product is available under the gogs gogs CPE. These versions are listed by the CNA as affected and have not been patched until the 0.14.1 release, which removes the unauthenticated upload capability.

The CVSS base score of 6.9 indicates a moderate‑to‑high risk. The EPSS score is below 1 %, suggesting a low probability of exploitation, and the vulnerability is not currently in the CISA KEV catalog. Because the attack requires only an unauthenticated HTTP request to a publicly accessible endpoint, it can be carried out by anyone with network access to the instance. Attackers could then upload files that the service stores or serves to other users. While malicious execution is not guaranteed by the vulnerability alone, the presence of uploaded code creates a vector for subsequent compromise or denial‑of‑service.