Gogs stored XSS in PDF renderer
Priority MEDIUM 61CWE-79Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/. This issue has been fixed for gogs.io/gogs in version 0.13.3.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00395 33rd percentileScored 2026-11-07
Fix Fixed github.com/gogs/gogs (Go): 0.13.3-0.20250608224432-110117b2e5e5gogs.io/gogs (Go): 0.13.3-0.20250608224432-110117b2e5e5
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Gogs | gogs | up to 0.14.0+dev | — | No fix listed | CNA |
| — | github.com/gogs/gogs (Go) | before 0.13.3-0.20250608224432-110117b2e5e5 | 0.13.3-0.20250608224432-110117b2e5e5 | Patch available | GHSA-xh32-cx6c-cp4v |
| — | gogs.io/gogs (Go) | before 0.13.3-0.20250608224432-110117b2e5e5 | 0.13.3-0.20250608224432-110117b2e5e5 | Patch available | GHSA-xh32-cx6c-cp4v |
- gogs VendorGogs Affected up to 0.14.0+dev Fixed in — No fix listed CNA
- github.com/gogs/gogs (Go) Vendor— Affected before 0.13.3-0.20250608224432-110117b2e5e5 Fixed in 0.13.3-0.20250608224432-110117b2e5e5 Patch available GHSA-xh32-cx6c-cp4v
- gogs.io/gogs (Go) Vendor— Affected before 0.13.3-0.20250608224432-110117b2e5e5 Fixed in 0.13.3-0.20250608224432-110117b2e5e5 Patch available GHSA-xh32-cx6c-cp4v
Remediation
- Fix · GHSA-xh32-cx6c-cp4v github.com/gogs/gogs (Go) Fixed in 0.13.3-0.20250608224432-110117b2e5e5 Advisory →
- Fix · GHSA-xh32-cx6c-cp4v gogs.io/gogs (Go) Fixed in 0.13.3-0.20250608224432-110117b2e5e5 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-47943
- 2026-10-03 Alias added: GHSA-xh32-cx6c-cp4v
References
Other 5
- https://github.com/gogs/gogs/security/advisories/GHSA-xh32-cx6c-cp4v
- https://github.com/gogs/gogs/commit/110117b2e5e5baa4809c819bec701e929d2d8d40
- https://github.com/gogs/gogs/releases/tag/v0.13.3
- https://www.hacktivesecurity.com/blog/2025/07/15/cve-2025-47943-stored-xss-in-gogs-via-pdf
- https://github.com/gogs/gogs
More Gogs vulnerabilities
- TI-2025-07419 File overwrite in file update API in Gogs KEVCVSS 4.0HIGH 8.7
- TI-2022-01876 OS Command Injection in gogs/gogs CVSS 3.1CRITICAL 9.8
- TI-2024-36988 Gogs has a Path Traversal in file update API CVSS 4.0HIGH 8.7
- TI-2026-37922 Gogs: Path Traversal in organization name results in RCE through Git hooks CVSS 3.1CRITICAL 10.0
- TI-2022-01744 Remote Command Execution in gogs/gogs CVSS 3.1CRITICAL 10.0
- TI-2025-39562 Gogs's update .git/config file allows remote command execution CVSS 4.0CRITICAL 9.3
Sources
- CVE-2025-47943 · CVE Program
- CVE-2025-47943 · NVD
- FIRST EPSS
- GHSA-xh32-cx6c-cp4v · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences