Gogs

Records76All Threatist records

Exploited (KEV)1In CISA KEV

CVSS critical17CVSS 9.0–10.0

CVSS high31CVSS 7.0–8.9

Exploited now

Gogs records in CISA KEV

TI-2025-07419 Gogs Path Traversal Vulnerability CRITICAL 97KEV 2026-01-12

Components

Products in the NVD configurations · select one to filter the records

Gogs 49 records CRITICAL

Records

49 records in Gogs · all components

TI-2025-07419 CVE-2025-8110 · GHSA-mq8m-42gh-wq7r

File overwrite in file update API in Gogs

CRITICAL 97KEV

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.85202 Published 2025-12-10 No fix listed CWE-22

TI-2022-01876 CVE-2022-2024 · GHSA-pfvh-p8qp-9ww9

OS Command Injection in gogs/gogs

CRITICAL 93

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.97839 Published 2023-02-25 Fixed in 0.12.11 CWE-78

TI-2024-36988 CVE-2024-55947 · GHSA-qf5v-rp47-55gg

Gogs has a Path Traversal in file update API

HIGH 83

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.77685 Published 2024-12-23 Fixed in 0.13.1 CWE-22

TI-2022-01744 CVE-2022-1884 · GHSA-958j-443g-7mm7

Remote Command Execution in gogs/gogs

HIGH 82

A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01841 Published 2024-11-15 Fixed in 0.12.8 CWE-78

TI-2025-39562 CVE-2025-64111 · GHSA-gg64-xxr9-qhjp

Gogs's update .git/config file allows remote command execution

HIGH 81

Gogs is an open source self-hosted Git service.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01375 Published 2026-02-06 Fixed in 0.14.0+dev, 0.13.4 CWE-78

TI-2026-20951 CVE-2026-25921 · GHSA-cj4v-437j-jq4c

Gogs: Cross-repository LFS object overwrite via missing content hash verification

HIGH 79

Gogs is an open source self-hosted Git service.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00372 Published 2026-03-05 Fixed in 0.14.2 CWE-345

TI-2024-36263 CVE-2024-54148 · GHSA-r7j8-5h9c-f6fx

Gogs has a Path Traversal in file editing UI

HIGH 79

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00855 Published 2024-12-23 Fixed in 0.13.1 CWE-22

TI-2024-26825 CVE-2024-39932 · GHSA-9pp6-wq8c-3w2c

Gogs through 0.13.0 allows argument injection during the previewing of changes.

HIGH 76

Gogs through 0.13.0 allows argument injection during the previewing of changes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.163 Published 2024-07-04 Fixed in 0.13.1 CWE-94

TI-2024-26823 CVE-2024-39930 · GHSA-vm62-9jw3-c8w3

The built-in SSH server of Gogs through 0.13.0 allows argument injection in…

HIGH 76

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.07743 Published 2024-07-04 Fixed in 0.13.1 CWE-88

TI-2024-26824 CVE-2024-39931 · GHSA-ccqv-43vm-4f3w

Gogs through 0.13.0 allows deletion of internal files.

HIGH 75

Gogs through 0.13.0 allows deletion of internal files.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.52658 Published 2024-07-04 Fixed in 0.13.1 CWE-552

TI-2022-13900 CVE-2022-32174 · GHSA-mcjj-2fvq-mc3r

Cross-site scripting in gogs

HIGH 75

In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.

CVSS 3.1CRITICAL 9.0 Network Low privileges User interaction EPSS 0.58246 Published 2022-10-11 No fix listed CWE-79

TI-2022-00340 CVE-2022-0415 · GHSA-5gjh-5j4f-cpwv

Remote Command Execution in uploading repository file in gogs/gogs

HIGH 74

Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.65935 Published 2022-03-21 Fixed in 0.12.6 CWE-20

TI-2020-12487 CVE-2020-15867

The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code…

HIGH 74

The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.87416 Published 2020-10-16 No fix listed

TI-2026-21036 CVE-2026-26022 · GHSA-xrcr-gmf5-2r8j

Gogs: Stored XSS via data URI in issue comments

HIGH 73

Gogs is an open source self-hosted Git service.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00354 Published 2026-03-05 Fixed in 0.14.2 CWE-79

TI-2024-29929 CVE-2024-44625 · GHSA-phm4-wf3h-pc3r

Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

HIGH 73

Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.16502 Published 2024-11-15 Fixed in 0.13.2 CWE-22

TI-2018-13406 CVE-2018-18925 · GHSA-59hg-cj84-76w9

Gogs 0.11.66 allows remote code execution because it does not properly validate session…

HIGH 66

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.31133 Published 2018-11-04 No fix listed CWE-384

TI-2026-19453 CVE-2026-24135 · GHSA-jp7c-wj6q-3qf2

Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update

HIGH 65

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00963 Published 2026-02-06 Fixed in 0.14.0+dev, 0.13.4 CWE-22

TI-2026-18153 CVE-2026-22592 · GHSA-cr88-6mqm-4g57

Gogs is Vulnerable to Denial of Service

MEDIUM 62

Gogs is an open source self-hosted Git service.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00373 Published 2026-02-06 Fixed in 0.14.0+dev, 0.13.4 CWE-862

TI-2022-01848 CVE-2022-1993 · GHSA-6vcc-v9vw-g2x5

Path Traversal in gogs/gogs

MEDIUM 61

Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.36725 Published 2022-06-08 Fixed in 0.12.9 CWE-22

TI-2024-37615 CVE-2024-56731 · GHSA-wj44-9vcg-wjq7

Gogs deletion of internal files allows remote command execution

MEDIUM 51

Gogs is an open source self-hosted Git service.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0115 Published 2025-06-24 Fixed in 0.13.3 CWE-552

TI-2022-01841 CVE-2022-1986 · GHSA-67mx-jc2f-jgjm

OS Command Injection in gogs/gogs

MEDIUM 49

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04216 Published 2022-06-09 Fixed in 0.12.9 CWE-78

TI-2026-21185 CVE-2026-26194 · GHSA-v9vm-r24h-6rqm

Gogs: Release tag option injection in release deletion

MEDIUM 45

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00543 Published 2026-03-05 Fixed in 0.14.2 CWE-88

TI-2019-10837 CVE-2019-14544 · GHSA-5r2v-6gm6-vpvh

routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.

MEDIUM 45

routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01528 Published 2019-08-02 Fixed in 0.11.91 CWE-862

TI-2022-01847 CVE-2022-1992 · GHSA-994f-7g86-qr56

Path Traversal in gogs/gogs

MEDIUM 44

Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.02307 Published 2022-06-08 Fixed in 0.12.9 CWE-22

TI-2022-00777 CVE-2022-0871 · GHSA-gw5h-h6hj-f56g

Missing Authorization in gogs/gogs

MEDIUM 42

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0124 Published 2022-03-11 Fixed in 0.12.5 CWE-862

Open these records in search →