Gogs

Records76All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical17CVSS 9.0–10.0

CVSS high31CVSS 7.0–8.9

Exploited now

Gogs records in CISA KEV

TI-2025-07419 Gogs Path Traversal Vulnerability CRITICAL 97KEV 2026-01-12

Components

Products in the NVD configurations · select one to filter the records

Gogs 49 records CRITICAL

Records

76 records

TI-2025-07419 CVE-2025-8110 · GHSA-mq8m-42gh-wq7r

File overwrite in file update API in Gogs

CRITICAL 97KEV

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.85202 Published 2025-12-10 No fix listed CWE-22

TI-2022-01876 CVE-2022-2024 · GHSA-pfvh-p8qp-9ww9

OS Command Injection in gogs/gogs

CRITICAL 93

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.97839 Published 2023-02-25 Fixed in 0.12.11 CWE-78

TI-2024-36988 CVE-2024-55947 · GHSA-qf5v-rp47-55gg

Gogs has a Path Traversal in file update API

HIGH 83

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.77685 Published 2024-12-23 Fixed in 0.13.1 CWE-22

TI-2026-37922 CVE-2026-52813 · GHSA-c39w-43gm-34h5

Gogs: Path Traversal in organization name results in RCE through Git hooks

HIGH 82

Gogs is an open source self-hosted Git service.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01107 Published 2026-06-24 Fixed in 0.14.3 CWE-23

TI-2022-01744 CVE-2022-1884 · GHSA-958j-443g-7mm7

Remote Command Execution in gogs/gogs

HIGH 82

A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01841 Published 2024-11-15 Fixed in 0.12.8 CWE-78

TI-2025-39562 CVE-2025-64111 · GHSA-gg64-xxr9-qhjp

Gogs's update .git/config file allows remote command execution

HIGH 81

Gogs is an open source self-hosted Git service.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01375 Published 2026-02-06 Fixed in 0.14.0+dev, 0.13.4 CWE-78

TI-2026-20951 CVE-2026-25921 · GHSA-cj4v-437j-jq4c

Gogs: Cross-repository LFS object overwrite via missing content hash verification

HIGH 79

Gogs is an open source self-hosted Git service.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00372 Published 2026-03-05 Fixed in 0.14.2 CWE-345

TI-2024-36263 CVE-2024-54148 · GHSA-r7j8-5h9c-f6fx

Gogs has a Path Traversal in file editing UI

HIGH 79

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00855 Published 2024-12-23 Fixed in 0.13.1 CWE-22

TI-2026-37915 CVE-2026-52806 · GHSA-qf6p-p7ww-cwr9

Gogs: RCE via git rebase --exec argument injection in pull request merge

HIGH 76

Gogs is an open source self-hosted Git service.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.07934 Published 2026-06-24 Fixed in 0.14.3 CWE-77

TI-2024-26825 CVE-2024-39932 · GHSA-9pp6-wq8c-3w2c

Gogs through 0.13.0 allows argument injection during the previewing of changes.

HIGH 76

Gogs through 0.13.0 allows argument injection during the previewing of changes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.163 Published 2024-07-04 Fixed in 0.13.1 CWE-94

TI-2024-26823 CVE-2024-39930 · GHSA-vm62-9jw3-c8w3

The built-in SSH server of Gogs through 0.13.0 allows argument injection in…

HIGH 76

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.07743 Published 2024-07-04 Fixed in 0.13.1 CWE-88

TI-2026-34847 CVE-2026-47267 · GHSA-c4v7-xg93-qf8g

Gogs: SSRF in webhook deliveries

HIGH 75

Gogs is an open source self-hosted Git service.

CVSS 3.1HIGH 8.3 Network No auth No interaction EPSS 0.0042 Published 2026-06-24 Fixed in 0.14.3 CWE-918

TI-2026-20282 CVE-2026-25119 · GHSA-w6j9-vw59-27wv

Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers

HIGH 75

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00863 Published 2026-06-24 Fixed in 0.14.3 CWE-290

TI-2024-26824 CVE-2024-39931 · GHSA-ccqv-43vm-4f3w

Gogs through 0.13.0 allows deletion of internal files.

HIGH 75

Gogs through 0.13.0 allows deletion of internal files.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.52658 Published 2024-07-04 Fixed in 0.13.1 CWE-552

TI-2022-13900 CVE-2022-32174 · GHSA-mcjj-2fvq-mc3r

Cross-site scripting in gogs

HIGH 75

In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.58246 Published 2022-10-11 No fix listed CWE-79

TI-2026-37908 CVE-2026-52798 · GHSA-jq8v-rmf6-65jw

Gogs: Stored XSS in `.ipynb` Preview

HIGH 74

Gogs is an open source self-hosted Git service.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00429 Published 2026-06-24 Fixed in 0.14.3 CWE-79

TI-2022-00340 CVE-2022-0415 · GHSA-5gjh-5j4f-cpwv

Remote Command Execution in uploading repository file in gogs/gogs

HIGH 74

Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.65935 Published 2022-03-21 Fixed in 0.12.6 CWE-20

TI-2020-12487 CVE-2020-15867

The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code…

HIGH 74

The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.87416 Published 2020-10-16 No fix listed

TI-2026-37910 CVE-2026-52800 · GHSA-pwx3-qcgw-vh7h

Gogs: CSRF Leading to Organization Owner Takeover

HIGH 73

Gogs is an open source self-hosted Git service.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00248 Published 2026-06-24 Fixed in 0.14.3 CWE-352

TI-2026-21036 CVE-2026-26022 · GHSA-xrcr-gmf5-2r8j

Gogs: Stored XSS via data URI in issue comments

HIGH 73

Gogs is an open source self-hosted Git service.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00354 Published 2026-03-05 Fixed in 0.14.2 CWE-79

TI-2024-29929 CVE-2024-44625 · GHSA-phm4-wf3h-pc3r

Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

HIGH 73

Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.16502 Published 2024-11-15 Fixed in 0.13.2 CWE-22

TI-2026-37909 CVE-2026-52799 · GHSA-p9f5-h3rx-j5qw

Gogs: Missing Authorization in Attachment Download

HIGH 72

Gogs is an open source self-hosted Git service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00422 Published 2026-06-24 Fixed in 0.14.3 CWE-639

TI-2026-37921 CVE-2026-52812 · GHSA-6p9m-q3jp-47h4

Gogs: LFS dedupe path leaks private repo content across tenants

HIGH 70

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00236 Published 2026-06-24 Fixed in 0.14.3 CWE-345

TI-2026-37907 CVE-2026-52797 · GHSA-pm6v-2h4w-4rp2

Gogs: Overwriting critical files results in a denial of service

HIGH 70

Gogs is an open source self-hosted Git service.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.0053 Published 2026-06-24 Fixed in 0.14.0 CWE-22

TI-2026-37911 CVE-2026-52801 · GHSA-wv27-2vqp-j7g5

Gogs: Ability to import local repositories via Mirror Settings

HIGH 68

Gogs is an open source self-hosted Git service.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00569 Published 2026-06-24 Fixed in 0.14.3 CWE-20

Open these records in search →