Vulnerabilities

TI-2026-21246 CVE-2026-26276 · GHSA-vgjm-2cpf-4g7c

Gogs: DOM-based XSS via milestone selection

LOW 33

Gogs is an open source self-hosted Git service.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00219 Published 2026-03-05 Fixed in 0.14.2 CWE-79

TI-2026-21187 CVE-2026-26196 · GHSA-x9p5-w45c-7ffc

Gogs: Access tokens get exposed through URL params in API requests

LOW 36

Gogs is an open source self-hosted Git service.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00295 Published 2026-03-05 Fixed in 0.14.2 CWE-598

TI-2026-21186 CVE-2026-26195 · GHSA-vgvf-m4fw-938j

Gogs: Stored XSS in branch and wiki views through author and committer names

LOW 36

Gogs is an open source self-hosted Git service.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00225 Published 2026-03-05 Fixed in 0.14.2 CWE-79

TI-2026-21185 CVE-2026-26194 · GHSA-v9vm-r24h-6rqm

Gogs: Release tag option injection in release deletion

MEDIUM 45

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.00543 Published 2026-03-05 Fixed in 0.14.2 CWE-88

TI-2026-20951 CVE-2026-25921 · GHSA-cj4v-437j-jq4c

Gogs: Cross-repository LFS object overwrite via missing content hash verification

HIGH 79

Gogs is an open source self-hosted Git service.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00372 Published 2026-03-05 Fixed in 0.14.2 CWE-345

TI-2026-21036 CVE-2026-26022 · GHSA-xrcr-gmf5-2r8j

Gogs: Stored XSS via data URI in issue comments

HIGH 73

Gogs is an open source self-hosted Git service.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00354 Published 2026-03-05 Fixed in 0.14.2 CWE-79

TI-2026-20377 CVE-2026-25229 · GHSA-cv22-72px-f4gh

Gogs Authorization Bypass Allows Cross-Repository Label Modification

LOW 24

Gogs is an open source self-hosted Git service.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00296 Published 2026-02-19 Fixed in 0.14.1, 0.14.0 CWE-284

TI-2026-20390 CVE-2026-25242 · GHSA-fc3h-92p8-h36f

Gogs allows unauthenticated file uploads

LOW 38

Gogs is an open source self-hosted Git service.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00681 Published 2026-02-19 Fixed in 0.14.1 CWE-862

TI-2026-20380 CVE-2026-25232 · GHSA-2c6v-8r3v-gh6p

Gogs has a Protected Branch Deletion Bypass in Web Interface

LOW 32

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00481 Published 2026-02-19 Fixed in 0.14.1 CWE-863

TI-2026-20283 CVE-2026-25120 · GHSA-jj5m-h57j-5gv7

Gogs Allows Cross-Repository Comment Deletion via DeleteComment

LOW 23

Gogs is an open source self-hosted Git service.

CVSS 4.0MEDIUM 5.1 Network High privileges No interaction EPSS 0.00305 Published 2026-02-19 Fixed in 0.14.0 CWE-639

TI-2026-19453 CVE-2026-24135 · GHSA-jp7c-wj6q-3qf2

Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update

HIGH 65

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00963 Published 2026-02-06 Fixed in 0.14.0+dev, 0.13.4 CWE-22

TI-2026-19032 CVE-2026-23633 · GHSA-mrph-w4hh-gx3g

Gogs has arbitrary file read/write via path traversal in Git hook editing

LOW 31

Gogs is an open source self-hosted Git service.

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00506 Published 2026-02-06 Fixed in 0.14.0+dev, 0.13.4 CWE-22

TI-2026-19031 CVE-2026-23632 · GHSA-5qhx-gwfj-6jqr

Gogs user can update repository content with read-only permission

LOW 29

Gogs is an open source self-hosted Git service.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00313 Published 2026-02-06 Fixed in 0.14.0+dev, 0.13.4 CWE-862

TI-2026-18153 CVE-2026-22592 · GHSA-cr88-6mqm-4g57

Gogs is Vulnerable to Denial of Service

MEDIUM 62

Gogs is an open source self-hosted Git service.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00373 Published 2026-02-06 Fixed in 0.14.0+dev, 0.13.4 CWE-862

TI-2025-39618 CVE-2025-64175 · GHSA-p6x6-9mx6-26wj

Gogs Vulnerable to 2FA Bypass via Recovery Code

LOW 36

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.0047 Published 2026-02-06 Fixed in 0.14.0+dev, 0.13.4 CWE-287

TI-2025-39562 CVE-2025-64111 · GHSA-gg64-xxr9-qhjp

Gogs's update .git/config file allows remote command execution

HIGH 81

Gogs is an open source self-hosted Git service.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.01375 Published 2026-02-06 Fixed in 0.14.0+dev, 0.13.4 CWE-78

TI-2025-07419 CVE-2025-8110 · GHSA-mq8m-42gh-wq7r

File overwrite in file update API in Gogs

CRITICAL 97KEV

Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.85202 Published 2025-12-10 No fix listed CWE-22

TI-2024-37615 CVE-2024-56731 · GHSA-wj44-9vcg-wjq7

Gogs deletion of internal files allows remote command execution

MEDIUM 51

Gogs is an open source self-hosted Git service.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0115 Published 2025-06-24 Fixed in 0.13.3 CWE-552

TI-2024-36988 CVE-2024-55947 · GHSA-qf5v-rp47-55gg

Gogs has a Path Traversal in file update API

HIGH 83

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.77685 Published 2024-12-23 Fixed in 0.13.1 CWE-22

TI-2024-36263 CVE-2024-54148 · GHSA-r7j8-5h9c-f6fx

Gogs has a Path Traversal in file editing UI

HIGH 79

Gogs is an open source self-hosted Git service.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00855 Published 2024-12-23 Fixed in 0.13.1 CWE-22

TI-2022-01744 CVE-2022-1884 · GHSA-958j-443g-7mm7

Remote Command Execution in gogs/gogs

HIGH 82

A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01841 Published 2024-11-15 Fixed in 0.12.8 CWE-78

TI-2024-29929 CVE-2024-44625 · GHSA-phm4-wf3h-pc3r

Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

HIGH 73

Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.16502 Published 2024-11-15 Fixed in 0.13.2 CWE-22

TI-2024-26826 CVE-2024-39933 · GHSA-m27m-h5gj-wwmg

Gogs through 0.13.0 allows argument injection during the tagging of a new release.

LOW 37

Gogs through 0.13.0 allows argument injection during the tagging of a new release.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00695 Published 2024-07-04 Fixed in 0.13.1 CWE-88

TI-2024-26825 CVE-2024-39932 · GHSA-9pp6-wq8c-3w2c

Gogs through 0.13.0 allows argument injection during the previewing of changes.

HIGH 76

Gogs through 0.13.0 allows argument injection during the previewing of changes.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.163 Published 2024-07-04 Fixed in 0.13.1 CWE-94

TI-2024-26824 CVE-2024-39931 · GHSA-ccqv-43vm-4f3w

Gogs through 0.13.0 allows deletion of internal files.

HIGH 75

Gogs through 0.13.0 allows deletion of internal files.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.52658 Published 2024-07-04 Fixed in 0.13.1 CWE-552

Vulnerabilities

Filters