Authenticated code execution via parent-symlink file write

Path traversal in Gogs before 0.14.3 allows remote authenticated users with repository write access to write files outside the working tree. The UploadRepoFiles path checks only the destination leaf for a symlink, then pathx.Clean turns a backslash in the multipart filename into a separator and os.Create follows a committed parent symlink. Repository write access and a real parent symlink on Linux or macOS are required; a write to an SSH key or Git hook grants code execution as the Gogs service account.