Read the docs
TI-2021-12220 Aliases CVE-2021-32546GHSA-56j7-2pm8-rgmx

Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an…

Priority MEDIUM 42CWE-78Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-78.

Summary

Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker (registered user) can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that configuration can contain an option such as sshCommand, which is executed when a master branch is a remote branch (using an ssh:// URI). The remote branch can also be configured by editing the Git configuration file. One can create a new file in a new repository, using the GUI, with "\" as its name, and then rename this file to .git/config with the custom configuration content (and then save it).

Why it matters now

EPSS 0.022 82nd percentileScored 2026-11-07
Fix Fixed gogs.io/gogs (Go): 0.12.8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—gogs.io/gogs (Go)before 0.12.80.12.8Patch availableGHSA-56j7-2pm8-rgmx
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • gogs.io/gogs (Go) Vendor— Affected before 0.12.8 Fixed in 0.12.8 Patch available GHSA-56j7-2pm8-rgmx

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*before 0.12.8VulnerableGogs
  • cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:* Versions before 0.12.8 Vulnerable ·Gogs

Remediation

  • Fix · GHSA-56j7-2pm8-rgmx gogs.io/gogs (Go) Fixed in 0.12.8 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-32546
  2. 2026-10-03 Alias added: GHSA-56j7-2pm8-rgmx

References

Advisory 3

Other 5

  • TI-2025-07419 File overwrite in file update API in Gogs KEVCVSS 4.0HIGH 8.7
  • TI-2022-01876 OS Command Injection in gogs/gogs CVSS 3.1CRITICAL 9.8
  • TI-2024-36988 Gogs has a Path Traversal in file update API CVSS 4.0HIGH 8.7
  • TI-2022-01744 Remote Command Execution in gogs/gogs CVSS 3.1CRITICAL 10.0
  • TI-2025-39562 Gogs's update .git/config file allows remote command execution CVSS 4.0CRITICAL 9.3
  • TI-2026-20951 Gogs: Cross-repository LFS object overwrite via missing content hash verification CVSS 3.1CRITICAL 9.3
See all 48 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences