Skip to content
OpenAdvisories
High WID-SEC-2026-0623 6 CVEs

Gogs: Mehrere Schwachstellen

Published Mar 5, 2026 · Updated Mar 5, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder vertrauliche Informationen offenzulegen.

Product

Gogs ist ein einfacher Git-Server.

Vulnerabilities 6

  • Critical 9.3
    CVE-2026-25921

    Gogs: Cross-repository LFS object overwrite via missing content hash verification

    Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patc…

    Gogs Gogs gogs.io/gogs Go
  • High 8.8
    CVE-2026-26194

    Gogs: Release tag option injection in release deletion

    Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess…

    Gogs Gogs gogs.io/gogs Go
  • High 8.7
    CVE-2026-26022

    Gogs: Stored XSS via data URI in issue comments

    Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enablin…

    Gogs Gogs gogs.io/gogs Go
  • High 7.3
    CVE-2026-26276

    Gogs: DOM-based XSS via milestone selection

    Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is tr…

    Gogs Gogs gogs.io/gogs Go
  • Medium 6.9
    CVE-2026-26195

    Gogs: Stored XSS in branch and wiki views through author and committer names

    Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.1…

    Gogs Gogs gogs.io/gogs Go
  • Medium 6.9
    CVE-2026-26196

    Gogs: Access tokens get exposed through URL params in API requests

    Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_token, which can leak through logs, browser history, and referrers. This issue has been patched in version 0.14.2.

    Gogs Gogs gogs.io/gogs Go

Revision history

  1. #1

    Initiale Fassung

References