Vulnerability advisory

GHSA-9hxg-w7qf-hh93

Gogs Directory Traversal

Published May 14, 2022Updated May 14, 2026OSV record ↗

Also known as CVE-2018-20303

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected versions

gogs.io/gogs Go

All gogs.io/gogs advisories →

Affected	Fixed in
All versions before 0.11.80-0.20181218063808-ff93d9dbda5c	`0.11.80-0.20181218063808-ff93d9dbda5c`

Description

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2018-20303 ↗
Webgithub.com/gogs/gogs/issues/5558 ↗
Webgithub.com/gogs/gogs/commit/ff93d9dbda5cebe90d86e4b7dfb2c6b8642970ce ↗
Packagegithub.com/gogs/gogs ↗
Webpentesterlab.com/exercises/cve-2018-18925 ↗