Skip to content
OpenAdvisories
Critical WID-SEC-2026-2013 28 CVEs

Gogs: Mehrere Schwachstellen

Published Jun 18, 2026 · Updated Jun 24, 2026 · Revision 2 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen – sogar mit erweiterten Berechtigungen, was zur vollständigen Kontrolle über das System führen kann –, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten oder einen Denial-of-Service-Zustand zu verursachen.

Product

Gogs ist ein einfacher Git-Server.

Vulnerabilities 28

  • Critical 10.0
    CVE-2026-52813 Public exploit

    Gogs: Path Traversal in organization name results in RCE through Git hooks

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrievin…

    Gogs Gogs gogs.io/gogs Go
  • Critical 9.9
    CVE-2024-39930 Public exploit

    Gogs has an argument Injection in the built-in SSH server

    The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the …

    gogs.io/gogs github.com/gogs/gogs Go
  • Critical 9.9
    CVE-2024-39932 EPSS 16%

    Gogs allows argument injection during the previewing of changes

    Gogs through 0.13.0 allows argument injection during the previewing of changes.

    gogs.io/gogs github.com/gogs/gogs Go
  • Critical 9.9
    CVE-2026-52806 Public exploit Scanner template

    Gogs: RCE via git rebase --exec argument injection in pull request merge

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git reb…

    Gogs Gogs gogs.io/gogs Go
  • Critical 9.0
    CVE-2026-52811

    Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only on the leaf of the upload target (osx.IsSymlink(targetPath)). The siblings UpdateRepoFile, DeleteRepoFile, and GetDiffPreview use hasSymlin…

    Gogs Gogs gogs.io/gogs Go
  • High 8.9
    CVE-2026-52798

    Gogs: Stored XSS in `.ipynb` Preview

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, although .ipynb previews are sanitized on the server side via /-/api/sanitize_ipynb, the inserted content is re-rendered on the client side without sanitization using marked() on elements with t…

    Gogs Gogs gogs.io/gogs Go
  • High 8.8
    CVE-2026-26194

    Gogs: Release tag option injection in release deletion

    Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess…

    Gogs Gogs gogs.io/gogs Go
  • High 8.8
    CVE-2026-52800

    Gogs: CSRF Leading to Organization Owner Takeover

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, …

    Gogs Gogs gogs.io/gogs Go
  • High 8.7
    CVE-2026-52805

    Gogs: Migration Redirect Bypass Leads to Internal Repository Theft

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery (SSRF) vulnerability exists in the repository migration functionality. The application validates only the initially submitted URL hostname, but git clone --mirror f…

    Gogs Gogs gogs.io/gogs Go
  • High 8.3
    CVE-2022-1285

    Server-Side Request Forgery (SSRF) in gogs/gogs

    Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8.

    Gogs gogs/gogs gogs.io/gogs gogs Alpine Go
  • High 8.3
    CVE-2026-47267

    Gogs: SSRF in webhook deliveries

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in localCIDRs. However, webhooks still follow redirects allowing to access hostname …

    Gogs Gogs gogs.io/gogs Go
  • High 8.1
    CVE-2026-52801

    Gogs: Ability to import local repositories via Mirror Settings

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New Migration functionality for any authenticated users to import local repositories. This issue stems f…

    Gogs Gogs gogs.io/gogs Go
  • High 7.7
    CVE-2024-39933

    Gogs allows argument Injection when tagging new releases

    Gogs through 0.13.0 allows argument injection during the tagging of a new release.

    gogs.io/gogs github.com/gogs/gogs Go
  • High 7.7
    CVE-2026-25119

    Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests without validating that the request…

    Gogs Gogs gogs.io/gogs Go
  • High 7.5
    CVE-2026-52799

    Gogs: Missing Authorization in Attachment Download

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, GET /attachments/:uuid returns the raw attachment file without verifying whether the requester has view permission for the associated Issue/Comment/Release or the repository. In a test environme…

    Gogs Gogs gogs.io/gogs Go
  • High 7.1
    CVE-2026-52808

    Gogs: Write-level collaborators can mutate admin-only repository settings via API

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, three API endpoints — PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync — are gated by reqRepoWriter() rather…

    Gogs Gogs gogs.io/gogs Go
  • High 7.1
    CVE-2026-52810 Public exploit

    Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query string (so ?service=git-upload-pack is evaluated as read access) while routing still runs git receive-pa…

    Gogs Gogs
  • High 7.1
    CVE-2026-52812

    Gogs: LFS dedupe path leaks private repo content across tenants

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone (<LFS-root>/<oid[0]>/<oid[1]>/<oid>) but per-repo authorization lives in the lfs_object table keyed (repo_id, oid). serveUpload skips re-uploadi…

    Gogs Gogs gogs.io/gogs Go
  • Medium 6.8
    CVE-2026-52809

    Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the account-activation lifetime), not conf.Auth.ResetPasswordCodeLives. The token lifetime is baked into the token itself a…

    Gogs Gogs gogs.io/gogs Go
  • Medium 5.5
    CVE-2026-52804

    Gogs: Privilege Escalation via Collaboration Access Mode Validation

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collaborator can escalate their privileges to owner-level access by exploiting an off-by-one error in the ChangeCollaborationAccessMode function. This vulnerability is fixed i…

    Gogs Gogs gogs.io/gogs Go
  • Medium 5.5
    CVE-2026-52814

    Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs built-in Go SSH server is vulnerable to an unauthenticated, asymmetric Denial of Service (DoS) attack. The application accepts inbound TCP connections and passes them to golang.org/x/cr…

    Gogs Gogs gogs.io/gogs Go
  • Medium 5.5
    CVE-2026-52815 Scanner template

    Gogs: Unauthenticated Organization Teams Information Disclosure via API

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization witho…

    Gogs Gogs gogs.io/gogs Go
  • Medium 5.4
    CVE-2026-52802

    Gogs: Open Redirect via redirect_to in Gogs

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, an open redirect vulnerability exists in Gogs where attacker-controlled redirect_to parameters can bypass validation, allowing redirection to arbitrary external sites. All redirects in Gogs that…

    Gogs Gogs gogs.io/gogs Go
  • Medium 5.4
    CVE-2026-52816

    Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary data: URIs without proper restrictions, potentially leading to Cross-Site Scripting (XSS). The endp…

    Gogs Gogs gogs.io/gogs Go
  • Medium 4.9
    CVE-2025-64719

    Gogs: Denial of Service in repository/wiki file listing web pages

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error…

    Gogs Gogs gogs.io/gogs Go
  • Medium 4.8
    CVE-2026-52807

    Gogs: DOM-based XSS via Milestone Name on New Issue Page

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go's default auto-escaping ({{.Name}}), which converts < to &lt; etc. This prevents direct HTML injection. However, when the browser renders t…

    Gogs Gogs gogs.io/gogs Go
  • Medium 4.3
    CVE-2026-52795

    Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity

    Gogs is an open source self-hosted Git service. In 0.14.3 and earlier, any authenticated user can watch a private repository they have no access to, because the access check in the Watch API handler is inverted. The code checks if repoCtx.ViewerCanRead() (ret…

    Gogs Gogs
  • Low 3.5
    CVE-2026-52796

    Gogs: DoS in rendering issue index pattern

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, specially crafted issue index pattern can cause a panic when rendering, resulting in denial of service. In internal/markup/markup.go, RenderIssueIndexPattern renders the issue index pattern to a…

    Gogs Gogs gogs.io/gogs Go

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2026-39064, EUVD-2026-39079, EUVD-2026-39077, EUVD-2026-39076, EUVD-2026-39075, EUVD-2026-39074, EUVD-2026-39073, EUVD-2026-39072, EUVD-2026-39071, EUVD-2026-39069, EUVD-2026-39062, EUVD-2026-39061, EUVD-2026-39067, EUVD-2026-39082, EUVD-2026-39084, EUVD-2026-39081, EUVD-2026-39068, EUVD-2026-39083, EUVD-2026-39070, EUVD-2026-39066, EUVD-2026-39065, EUVD-2026-39063, EUVD-2025-210329

  2. #1

    Initiale Fassung

References