Vulnerability advisory

GHSA-xh32-cx6c-cp4v

Gogs XSS allowed by stored call in PDF renderer

Published Jun 26, 2025Updated Sep 10, 2026OSV record ↗

Also known as CVE-2025-47943GO-2025-3778

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Affected versions

github.com/gogs/gogs Go

All github.com/gogs/gogs advisories →

Affected	Fixed in
All versions before 0.13.3-0.20250608224432-110117b2e5e5	`0.13.3-0.20250608224432-110117b2e5e5`

gogs.io/gogs Go

All gogs.io/gogs advisories →

Affected	Fixed in
All versions before 0.13.3-0.20250608224432-110117b2e5e5	`0.13.3-0.20250608224432-110117b2e5e5`

Description

Summary

A stored XSS is present in Gogs which allows client-side Javascript code execution.

Details

Gogs Version:

docker images
REPOSITORY   TAG       IMAGE ID       CREATED        SIZE
gogs/gogs    latest    fe92583bc4fe   10 hours ago   99.3MB

Application version: 0.14.0+dev

Local setup using:

# Pull image from Docker Hub.
docker pull gogs/gogs

# Create local directory for volume.
sudo mkdir -p /var/gogs

# Use `docker run` for the first time.
docker run --name=gogs -p 10022:22 -p 10880:3000 -v /var/gogs:/data gogs/gogs

The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/.
Read more about this vulnerability at codeanlabs - CVE-2024-4367.

PoC

Upload the Proof of Concept file hosted at https://codeanlabs.com/wp-content/uploads/2024/05/poc_generalized_CVE-2024-4367.pdf in a repository.
Click on the file to be previewed.

[image: poc]

Credits

Edoardo Ottavianelli