Gogs allows an authorized user to supply a value that bypasses path filtering in the git diff command, enabling writes to arbitrary locations on the file system, potentially overwriting critical files and causing a denial of service.

Gogs instances running any version earlier than 0.14.0 are vulnerable. The issue exists for all deployments of gogs:gogs before the patch.

The CVSS score of 8.5 indicates a high severity. The EPSS score is not available and the vulnerability is not listed in CISA KEV. It is exploitable only by an authenticated user with write access through the Git interface. Once exploited, an attacker can overwrite critical files and potentially cause application downtime or corruption.