Skip to content
OpenAdvisories

Package · Go

gogs.io/gogs

76 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-52813 Public exploit

    Gogs: Path Traversal in organization name results in RCE through Git hooks

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrievin…

    Gogs Gogs gogs.io/gogs Go
  • Critical 9.9
    CVE-2026-52806 Public exploit Scanner template

    Gogs: RCE via git rebase --exec argument injection in pull request merge

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git reb…

    Gogs Gogs gogs.io/gogs Go
  • Critical 9.9
    CVE-2024-39930 Public exploit

    Gogs has an argument Injection in the built-in SSH server

    The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the …

    gogs.io/gogs github.com/gogs/gogs Go