Skip to content
OpenAdvisories
High WID-SEC-2026-0338 5 CVEs

Gogs: Mehrere Schwachstellen

Published Feb 8, 2026 · Updated Feb 8, 2026 · de-DE

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.

Product

Gogs ist ein einfacher Git-Server.

Vulnerabilities 5

  • High 7.7
    CVE-2025-64175

    Gogs Vulnerable to 2FA Bypass via Recovery Code

    Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use any unused recover…

    Gogs Gogs gogs.io/gogs Go
  • High 7.2
    CVE-2026-24135 Public exploit

    Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update

    Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitr…

    Gogs Gogs gogs.io/gogs Go
  • Medium 6.5
    CVE-2026-22592

    Gogs is Vulnerable to Denial of Service

    Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, an authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash. This issue has been patched in versi…

    Gogs Gogs gogs.io/gogs Go
  • Medium 6.5
    CVE-2026-23632

    Gogs user can update repository content with read-only permission

    Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint "PUT /repos/:owner/:repo/contents/*" does not require write permissions and allows access with read permission only via repoAssignment(). After passing the permission ch…

    Gogs Gogs gogs.io/gogs Go
  • Medium 6.5
    CVE-2026-23633

    Gogs has arbitrary file read/write via path traversal in Git hook editing

    Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

    Gogs Gogs gogs.io/gogs Go

Revision history

  1. #1

    Initiale Fassung

References