project
Self-hosted Git service named in the bulletin headline for a 10.0 remote code execution issue; no detail is provided in the supplied body.
No evidence-backed relationships are recorded.
Rapid7 scored it 9.9 and Gogs shipped 0.14.3 on June 7, 2026. The reason it rates that high is configuration: open registration and unlimited repository creation let a stranger own the repo they attack from.
Reality
Wiz's count of exploited Gogs instances rests on one attacker's habit of leaving its randomly named repositories in place, which makes 700 of 1,500 a floor for a single campaign rather than a measure of who is exposed.
Reality
The patch for the last Gogs RCE validated the path parameter and never looked at where a committed symlink pointed. Wiz counted more than 700 already-compromised instances before v0.13.4 shipped.
Reality
An SC Media commentary says ColdFusion and Gogs exploitation shows adversaries going after developer platforms directly. The targeting logic holds up better than the remedy attached to it.
Reality
Check Point says Microsoft's signed BTR.sys remediation driver can be repurposed as a kernel operation engine with no vulnerable driver needed. Signature-based blocking does not apply.
Reality