gogs.io/gogs vulnerabilities

76 known advisories · Dependencies not checked

SEVERITYADVISORYPUBLISHED

CriticalGogs has Path Traversal in organization name that results in RCE through Git hooksGHSA-c39w-43gm-34h5CVE-2026-52813GO-2026-5305Affected *Fixed in 0.14.3OSV source ↗5 months ago

CriticalGogs vulnerable to RCE via git rebase --exec argument injection in pull request mergeGHSA-qf6p-p7ww-cwr9CVE-2026-52806GO-2026-5580Affected *Fixed in 0.14.3OSV source ↗5 months ago

CriticalGogs: UploadRepoFiles writes outside repo working tree via committed parent symGHSA-89mr-xqfv-758mCVE-2026-52811GO-2026-5249Affected *Fixed in 0.14.3OSV source ↗5 months ago

CriticalGogs's update .git/config file allows remote command executionGHSA-gg64-xxr9-qhjpCVE-2025-64111GO-2026-4448Affected *Fixed in 0.13.4OSV source ↗9 months ago

CriticalGogs: Cross-repository LFS object overwrite via missing content hash verificationGHSA-cj4v-437j-jq4cCVE-2026-25921GO-2026-4616Affected *Fixed in 0.14.2OSV source ↗8 months ago

CriticalGogs vulnerable to Cross-site ScriptingGHSA-mcjj-2fvq-mc3rCVE-2022-32174GO-2022-1060Affected >=0.6.5OSV source ↗4 years ago

HighGogs has Stored XSS in `.ipynb` PreviewGHSA-jq8v-rmf6-65jwCVE-2026-52798GO-2026-5477Affected *Fixed in 0.14.3OSV source ↗5 months ago

HighGogs Vulnerable to CSRF Leading to Organization Owner TakeoverGHSA-pwx3-qcgw-vh7hCVE-2026-52800GO-2026-5556Affected *Fixed in 0.14.3OSV source ↗5 months ago

HighRemote Code Execution in GogsGHSA-phm4-wf3h-pc3rCVE-2024-44625GO-2024-3275Affected *Fixed in 0.13.2OSV source ↗2 years ago

HighGogs has a Migration Redirect Bypass that Leads to Internal Repository TheftGHSA-g2f5-gjr4-qjvmCVE-2026-52805GO-2026-5387Affected *Fixed in 0.14.3OSV source ↗5 months ago

HighGogs: Stored XSS via data URI in issue commentsGHSA-xrcr-gmf5-2r8jCVE-2026-26022GO-2026-4620Affected *Fixed in 0.14.2OSV source ↗8 months ago

HighGogs: Overwriting critical files results in a denial of serviceGHSA-pm6v-2h4w-4rp2CVE-2026-52797GO-2026-5545Affected *Fixed in 0.14.0OSV source ↗5 months ago

HighGogs has SSRF in webhook deliveriesGHSA-c4v7-xg93-qf8gCVE-2026-47267GO-2026-5312Affected *Fixed in 0.14.3OSV source ↗5 months ago

HighGogs has the ability to import local repositories via Mirror SettingsGHSA-wv27-2vqp-j7g5CVE-2026-52801GO-2026-5724Affected *Fixed in 0.14.3OSV source ↗5 months ago

HighGogs: LFS dedupe path leaks private repo content across tenantsGHSA-6p9m-q3jp-47h4CVE-2026-52812GO-2026-5184Affected *Fixed in 0.14.3OSV source ↗5 months ago

HighGogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusionGHSA-wmfg-5p4h-5fw3CVE-2026-123012CVE-2026-52810GO-2026-5712Affected *Fixed in 0.14.3OSV source ↗5 months ago

HighGogs has an Authentication Bypass via Unvalidated Reverse Proxy HeadersGHSA-w6j9-vw59-27wvCVE-2026-25119GO-2026-5695Affected *Fixed in 0.14.3OSV source ↗5 months ago

HighGogs: XSS in .ipynb files renderer due to outdated notebookjsGHSA-6vxv-wg6j-5qwpGO-2026-5193Affected *Fixed in 0.14.3OSV source ↗5 months ago

HighGogs: Release tag option injection in release deletionGHSA-v9vm-r24h-6rqmCVE-2026-26194GO-2026-4617Affected *Fixed in 0.14.2OSV source ↗8 months ago

HighGogs has a Protected Branch Deletion Bypass in Web InterfaceGHSA-2c6v-8r3v-gh6pCVE-2026-25232GO-2026-4498Affected *Fixed in 0.14.1OSV source ↗9 months ago

HighGogs vulnerable to arbitrary file deletion via Path Traversal in wiki page updateGHSA-jp7c-wj6q-3qf2CVE-2026-24135GO-2026-4452Affected *Fixed in 0.13.4OSV source ↗9 months ago

HighGogs Vulnerable to 2FA Bypass via Recovery CodeGHSA-p6x6-9mx6-26wjCVE-2025-64175GO-2026-4449Affected >=0.11.19Fixed in 0.13.4OSV source ↗9 months ago

HighGogs vulnerable to a bypass of CVE-2024-55947GHSA-mq8m-42gh-wq7rCVE-2025-8110GO-2025-4225Affected *OSV source ↗11 months ago

HighGogs Missing Authorization in Attachment DownloadGHSA-p9f5-h3rx-j5qwCVE-2026-52799GO-2026-5536Affected *Fixed in 0.14.3OSV source ↗5 months ago

HighGogs: DOM-based XSS via milestone selectionGHSA-vgjm-2cpf-4g7cCVE-2026-26276GO-2026-4627Affected *OSV source ↗8 months ago

HighGogs vulnerable to Stored XSS via Mermaid diagramsGHSA-26gq-grmh-6xm6GO-2026-4454Affected *Fixed in 0.13.4OSV source ↗9 months ago

HighGogs's write-level collaborators can mutate admin-only repository settings via APIGHSA-268j-37xf-pp52CVE-2026-52808GO-2026-5065Affected *Fixed in 0.14.3OSV source ↗5 months ago

MediumGogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVESGHSA-5c3f-6486-3g7gCVE-2026-52809GO-2026-5140Affected *Fixed in 0.14.3OSV source ↗5 months ago

MediumGogs has arbitrary file read/write via Path Traversal in Git hook editingGHSA-mrph-w4hh-gx3gCVE-2026-23633GO-2026-4453Affected *Fixed in 0.13.4OSV source ↗9 months ago

Medium Gogs user can update repository content with read-only permissionGHSA-5qhx-gwfj-6jqrCVE-2026-23632GO-2026-4450Affected *Fixed in 0.13.4OSV source ↗9 months ago

MediumGogs has a Denial of Service issueGHSA-cr88-6mqm-4g57CVE-2026-22592GO-2026-4451Affected *Fixed in 0.13.4OSV source ↗9 months ago

MediumGogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSSGHSA-3w28-36p9-w929CVE-2026-52816GO-2026-5103Affected *Fixed in 0.14.3OSV source ↗5 months ago

MediumGogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via APIGHSA-744x-3838-5r56CVE-2026-52815GO-2026-5202Affected *Fixed in 0.14.3OSV source ↗5 months ago

MediumGogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)GHSA-xp79-5mx3-jx52CVE-2026-52814GO-2026-5765Affected *Fixed in 0.14.3OSV source ↗5 months ago

MediumGogs has DOM-based XSS via Milestone Name on New Issue PageGHSA-vcm5-gvmp-78mpCVE-2026-52807GO-2026-5661Affected *Fixed in 0.14.3OSV source ↗5 months ago

MediumGogs Vulnerable to Privilege Escalation via Collaboration Access Mode ValidationGHSA-4565-r4x7-hg8jCVE-2026-52804GO-2026-5110Affected *Fixed in 0.14.3OSV source ↗5 months ago

MediumGogs: Stored XSS in branch and wiki views through author and committer namesGHSA-vgvf-m4fw-938jCVE-2026-26195GO-2026-4618Affected *OSV source ↗8 months ago

MediumUnauthenticated File Upload in GogsGHSA-fc3h-92p8-h36fCVE-2026-25242GO-2026-4500Affected *Fixed in 0.14.1OSV source ↗9 months ago

MediumGogs has an Authorization Bypass Allows Cross-Repository Label Modification in GogsGHSA-cv22-72px-f4ghCVE-2026-25229GO-2026-4499Affected *Fixed in 0.14.0OSV source ↗9 months ago

MediumGogs Allows Cross-Repository Comment Deletion via DeleteCommentGHSA-jj5m-h57j-5gv7CVE-2026-25120GO-2026-4501Affected *Fixed in 0.14.0OSV source ↗9 months ago

MediumGogs has authorization bypass in repository deletion APIGHSA-rjv5-9px2-fqw6CVE-2025-65852GO-2026-4457Affected *Fixed in 0.13.4OSV source ↗9 months ago

MediumGogs has an Open Redirect via redirect_toGHSA-xxhq-69mf-w8crCVE-2026-52802GO-2026-5773Affected *Fixed in 0.14.3OSV source ↗5 months ago

MediumGogs: Access tokens get exposed through URL params in API requestsGHSA-x9p5-w45c-7ffcCVE-2026-26196GO-2026-4619Affected *OSV source ↗8 months ago

MediumGogs has a Denial of Service in repository/wiki file listing web pagesGHSA-3qq3-668m-v9mjCVE-2025-64719GO-2026-5098Affected *Fixed in 0.14.3OSV source ↗5 months ago

LowGogs has DoS in rendering issue index patternGHSA-4j89-2c4f-44c6CVE-2026-52796GO-2026-5124Affected *Fixed in 0.14.3OSV source ↗5 months ago

CriticalGogs allows deletion of internal files which leads to remote command executionGHSA-wj44-9vcg-wjq7CVE-2024-56731GO-2025-3776Affected <0.13.3Fixed in 0.13.3OSV source ↗last year

CriticalOS Command Injection in gogsGHSA-958j-443g-7mm7CVE-2022-1884GO-2022-0749Affected <0.12.8Fixed in 0.12.8OSV source ↗4 years ago

CriticalGogs has an argument Injection in the built-in SSH serverGHSA-vm62-9jw3-c8w3CVE-2024-39930GHSA-p69r-v3h4-rj4fGO-2024-2969Affected <0.13.1Fixed in 0.13.1OSV source ↗2 years ago

CriticalGogs allows argument injection during the previewing of changesGHSA-9pp6-wq8c-3w2cCVE-2024-39932GHSA-hf29-9hfh-w63jGO-2024-2971Affected <0.13.1Fixed in 0.13.1OSV source ↗2 years ago

CriticalGogs allows deletion of internal filesGHSA-ccqv-43vm-4f3wCVE-2024-39931GHSA-2vgj-3pvg-xh4wGO-2024-2970Affected <0.13.1Fixed in 0.13.1OSV source ↗2 years ago

CriticalRemote Command Execution in file editing in gogsGHSA-r7j8-5h9c-f6fxCVE-2024-54148GO-2024-3355Affected <0.13.1Fixed in 0.13.1OSV source ↗2 years ago

CriticalGogs OS Command Injection vulnerabilityGHSA-pfvh-p8qp-9ww9CVE-2022-2024GO-2023-1596Affected <0.12.11Fixed in 0.12.11OSV source ↗2 years ago

CriticalOS Command Injection in file editor in GogsGHSA-67mx-jc2f-jgjmCVE-2022-1986GO-2022-0556Affected <0.12.9Fixed in 0.12.9OSV source ↗4 years ago

CriticalInsecure Permissions in GogsGHSA-5r2v-6gm6-vpvhCVE-2019-14544GO-2022-0797Affected <0.11.91Fixed in 0.11.91OSV source ↗5 years ago

CriticalOS Command Injection in gogsGHSA-56j7-2pm8-rgmxCVE-2021-32546GO-2022-0471Affected <0.12.8Fixed in 0.12.8OSV source ↗4 years ago

CriticalPath Traversal in file editor on Windows in GogsGHSA-994f-7g86-qr56CVE-2022-1992GO-2022-0570Affected <0.12.9Fixed in 0.12.9OSV source ↗4 years ago

HighPath Traversal in file update API in gogsGHSA-qf5v-rp47-55ggCVE-2024-55947GO-2024-3356Affected <0.13.1Fixed in 0.13.1OSV source ↗2 years ago

HighUnrestricted Upload of File with Dangerous Type in GogsGHSA-5gjh-5j4f-cpwvCVE-2022-0415GO-2022-0554Affected <0.12.6Fixed in 0.12.6OSV source ↗2 years ago

HighGogs and Gitea SSRF VulnerabilityGHSA-fg3x-rwq9-74cwCVE-2018-15192GO-2023-1971Affected <0.12.0Fixed in 0.12.0OSV source ↗4 years ago

HighServer-Side Request Forgery in gogs webhookGHSA-w689-557m-2cvqCVE-2022-1285GO-2022-0583Affected <0.12.8Fixed in 0.12.8OSV source ↗4 years ago

HighGogs vulnerable to improper PAM authorization handlingGHSA-gw5h-h6hj-f56gCVE-2022-0871GO-2022-0369Affected <0.12.5Fixed in 0.12.5OSV source ↗5 years ago

HighPath Traversal in Git HTTP endpoints in GogsGHSA-6vcc-v9vw-g2x5CVE-2022-1993GO-2022-0562Affected <0.12.9Fixed in 0.12.9OSV source ↗4 years ago

HighGogs allows argument Injection when tagging new releasesGHSA-m27m-h5gj-wwmgCVE-2024-39933GHSA-8mm6-wmpp-mmm3GO-2024-2972Affected <0.13.1Fixed in 0.13.1OSV source ↗2 years ago

HighGogs Directory TraversalGHSA-9hxg-w7qf-hh93CVE-2018-20303Affected <0.11.80-0.20181218063808-ff93d9dbda5cFixed in 0.11.80-0.20181218063808-ff93d9dbda5cOSV source ↗4 years ago

HighSQL Injection in GogsGHSA-g6xv-8q23-w2q3CVE-2014-8682GO-2022-0831Affected >=0.3.1 <0.5.8Fixed in 0.5.8OSV source ↗2 years ago

MediumSQL Injection in gogs.io/gogsGHSA-mr6h-chqp-p9g2CVE-2014-8681GO-2020-0021Affected >=0.3.1 <0.5.8Fixed in 0.5.8OSV source ↗5 years ago

MediumGogs XSS allowed by stored call in PDF rendererGHSA-xh32-cx6c-cp4vCVE-2025-47943GO-2025-3778Affected <0.13.3-0.20250608224432-110117b2e5e5Fixed in 0.13.3-0.20250608224432-110117b2e5e5OSV source ↗last year

MediumOpen RedirectGHSA-cpgw-2wxr-pww3CVE-2018-15178GO-2022-0822Affected <0.12.0Fixed in 0.12.0OSV source ↗2 years ago

MediumGogs XSS VulnerabilityGHSA-px5r-fqj6-r2f8CVE-2018-17031GO-2023-1972Affected <0.12.0Fixed in 0.12.0OSV source ↗4 years ago

MediumCross-site Scripting in GogsGHSA-9hx4-qm7h-x84jCVE-2014-8683GO-2022-0642Affected >=0.3.1 <0.5.8Fixed in 0.5.8OSV source ↗2 years ago

MediumCross-site Scripting in GogsGHSA-ff28-f46g-r9g8CVE-2022-1464GO-2022-0597Affected <0.12.7Fixed in 0.12.7OSV source ↗2 years ago

MediumCross-site Scripting vulnerability in repository issue list in GogsGHSA-xq4v-vrp9-vcf2CVE-2022-31038GO-2022-0483Affected <0.12.9Fixed in 0.12.9OSV source ↗4 years ago

MediumInsecure Permissions in GogsGHSA-4c7m-vv47-7c69CVE-2020-14958GO-2022-0788Affected <0.12.0Fixed in 0.12.0OSV source ↗5 years ago

MediumSSRF in repository migrationGHSA-q347-cg56-pcq4GO-2022-0377Affected <0.12.5Fixed in 0.12.5OSV source ↗5 years ago

MediumSSRF in repository migrationGHSA-7v5r-r995-q2x2CVE-2022-0870GO-2022-0566Affected <0.12.5Fixed in 0.12.5OSV source ↗5 years ago

LowCross site scripting via cookies in gogsGHSA-pj96-4jhv-v792GO-2022-0473Affected <0.12.8Fixed in 0.12.8OSV source ↗4 years ago