Summary
Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um beliebigen Programmcode auszuführen, und um einen Cross-Site Scripting Angriff durchzuführen.
Product
Gogs ist ein einfacher Git-Server.
Vulnerabilities 2
-
Critical 10.0
Gogs deletion of internal files allows remote command execution
Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute …
-
Medium 6.3
Gogs stored XSS in PDF renderer
Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usa…
Revision history
-
#2
Referenz(en) aufgenommen: EUVD-2025-206887
-
#1
Initiale Fassung
References
-
Gogs Release 0.13.3 vom 2025-06-24
https://github.com/gogs/gogs/releases/tag/v0.13.3
-
GitHub Security Advisory GHSA-xh32-cx6c-cp4v vom 2025-06-24
https://github.com/gogs/gogs/security/advisories/GHSA-xh32-cx6c-cp4v
-
GitHub Security Advisory GHSA-wj44-9vcg-wjq7 vom 2025-06-24
https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7