Vulnerability advisory

CVE-2022-1464

Stored xss bug in gogs/gogs

Published May 5, 2022Updated Oct 28, 2026OSV record ↗

Also known as GHSA-ff28-f46g-r9g8GO-2022-0597

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/gogs/gogs ↗
All commits before d06ba7e527fcc462aecdb660ce001e87d94f024c	`d06ba7e527fcc462aecdb660ce001e87d94f024c`
Not specified	`bc77440b301ac8780698be91dff1ac33b7cee850`
Also listed as affected (63) `v0.12.6-rc.1` `v0.12.6` `v0.12.5-rc.1` `v0.12.5` `v0.12.4-rc.1` `v0.12.4` `v0.12.3` `v0.12.2` `v0.12.1` `v0.12.0` `v0.11.91` `v0.11.86` `v0.11.79` `v0.11.66` `v0.11.53` `v0.11.43` `v0.11.34` `v0.11.33` `v0.11.29` `v0.11.19` `v0.11.4` `v0.11` `v0.11rc` `v0.10.18` `v0.10.8` `v0.10` `v0.10rc` `v0.9.141` `v0.9.128` `v0.9.113` `v0.9.97` `v0.9.71` `v0.9.60` `v0.9.48` `v0.9.46` `v0.9.13` `v0.9.0` `v0.8.43` `v0.8.25` `v0.8.10` `v0.8.0` `v0.7.33` `v0.7.22` `v0.7.19` `v0.7.6` `v0.7.0` `v0.6.15` `v0.6.9` `v0.6.3` `v0.6.1` `v0.5.13` `v0.5.11` `v0.5.9` `v0.5.8` `v0.5.5` `v0.5.2` `v0.5.0` `v0.4.2` `v0.4.1` `v0.4.0` `v0.3.1` `v0.3.0` `v0.2.0`

Description

Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .

CVE-2022-1464

Affected versions

Repository

Description

References