Gist: A critical vulnerability in Gogs enables silent file overwrite and supply-chain compromise through shared LFS storage and missing hash verification. A patch is available, and users should restrict uploads and add integrity checks until upgrading.
Signal reason: The content describes a severe vulnerability and harmful attack path.
