Gogs’ UploadRepoFiles method only inspects the final component of an uploaded path for a symlink, ignoring any symlinks earlier in the path. An attacker with repository‑write permissions can submit a filename contains a literal backslash. On Linux, the backslash is preserved by filepath.Base and later normalized to a forward slash, allowing the write to traverse a previously‑committed directory symlink. Because iox.CopyFile opens the destination with os.Create without setting O_NOFOLLOW, the kernel follows that parent symlink and writes the attacker’s bytes to any location the Gogs process can write. This can overwrite critical files such as the .ssh/authorized_keys, granting an SSH foothold, or the repository’s .git/hooks/post‑receive, enabling remote code execution on every push.; The flaw reflects CWE‑22 (Path Traversal), CWE‑59 (Improper Handling of Symbolic Links), and CWE‑61 (Path Manipulation).

All Gogs installations running a version prior to 0.14.3 are affected, including installations where the Repository.UploadRepoFiles method is used.

The flaw enables overwriting critical files outside the repository working tree, which can lead to remote code execution or persistent footholds. By targeting .ssh/authorized_keys the attacker can gain SSH access; by tampering with hooks/post‑receive they can execute arbitrary code on each push. The identified weaknesses are CWE‑22, CWE‑59, and CWE‑61. With a CVSS score of 9, the vulnerability is considered high severity. The EPSS score is unavailable, and the issue is not listed in the CISA KEV catalog. Exploitation requires only repository write access because the Gogs process follows symlinks without O_NOFOLLOW, making an unpatched instance vulnerable to high‑impact attacks.