Organization names containing the path‑traversal sequence "../" are accepted by older versions of Gogs. This flaw allows an attacker to create repositories that resolve to arbitrary filesystem locations, enabling the overwriting or injection of Git hook scripts. Because hook scripts run with the process’s privileges, the attacker can achieve remote code execution. The weakness is a classic path traversal flaw, classified as CWE‑23.

The vulnerability exists in all Gogs releases prior to version 0.14.3. No specific patch version range beyond that is known, and all affected installations that have older releases are susceptible.

The CVSS score of 10 underscores the severity of this flaw, and the vulnerability is not yet listed in CISA’s KEV catalog. While the formal EPSS score is not available, the absence of an exploit in the public domain does not diminish the inherent risk; an attacker who can create an organization or repository can exploit the flaw. The attack vector is inferred to be application‑level, requiring the ability to create or modify organization names – typically achieved by an authenticated user with repository creation rights.