HTB Silentium Complete Writeup -CVE-2025-58434, CVE-2025-59528 & Gogs RCE

A comprehensive penetration testing guide exploiting Flowise unauthenticated account takeover, JavaScript code injection RCE, and a Gogs symlink bypass to achieve full root privilege escalation.

April 14, 2026 • views • 11 min read • 1,407 words

By

Havoc

hackthebox 23 htb 27 linux 8 cve-2025-58434 cve-2025-59528 cve-2025-64111 flowise gogs account-takeover password-reset-disclosure javascript-injection rce 5 nodejs custommcp mcp ai-platform symlink-bypass git-hook docker-escape 2 environment-variable-leakage privilege-escalation 14 ssh-tunneling nmap 6 vhost-enumeration season10 6 medium-difficulty 5