Skip to content
OpenAdvisories

Package · Go

gogs.io/gogs

76 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

10 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-52813 Public exploit

    Gogs: Path Traversal in organization name results in RCE through Git hooks

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrievin…

    Gogs Gogs gogs.io/gogs Go
  • Critical 9.9
    CVE-2026-52806 Public exploit

    Gogs: RCE via git rebase --exec argument injection in pull request merge

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git reb…

    Gogs Gogs gogs.io/gogs Go
  • High 7.1
    CVE-2026-25232 Public exploit

    Gogs has a Protected Branch Deletion Bypass in Web Interface

    Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a dire…

    Gogs Gogs gogs.io/gogs Go
  • High 7.2
    CVE-2026-24135 Public exploit

    Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update

    Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitr…

    Gogs Gogs gogs.io/gogs Go
  • High 8.7
    CVE-2025-8110 Exploited Public exploit EPSS 80%

    File overwrite in file update API in Gogs

    Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

    Gogs Gogs gogs.io/gogs Go
    KEV Jan 12, 2026
  • High 8.7
    CVE-2024-55947 Public exploit EPSS 78%

    Gogs has a Path Traversal in file update API

    Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

    Gogs Gogs gogs.io/gogs Go
  • High 8.8
    CVE-2024-44625 Public exploit EPSS 17%

    Remote Code Execution in Gogs

    Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

    gogs.io/gogs Go
  • Critical 9.9
    CVE-2024-39930 Public exploit

    Gogs has an argument Injection in the built-in SSH server

    The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the …

    gogs.io/gogs github.com/gogs/gogs Go
  • High 7.3
    CVE-2014-8682 Public exploit EPSS 33%

    SQL Injection in Gogs

    Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/r…

    gogs.io/gogs Go
  • Medium 6.5
    CVE-2014-8681 Public exploit

    SQL Injection in gogs.io/gogs

    SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta allows remote attackers to execute arbitrary SQL commands via the label parameter to user/repos/issues.

    gogs.io/gogs github.com/gogits/gogs Go