Skip to content
OpenAdvisories

Package · Go

gogs.io/gogs

76 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.1
    CVE-2026-25232 Public exploit

    Gogs has a Protected Branch Deletion Bypass in Web Interface

    Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a dire…

    Gogs Gogs gogs.io/gogs Go
  • High 7.2
    CVE-2026-24135 Public exploit

    Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update

    Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitr…

    Gogs Gogs gogs.io/gogs Go
  • High 8.7
    CVE-2025-8110 Exploited Public exploit EPSS 80%

    File overwrite in file update API in Gogs

    Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

    Gogs Gogs gogs.io/gogs Go
    KEV Jan 12, 2026
  • High 8.7
    CVE-2024-55947 Public exploit EPSS 78%

    Gogs has a Path Traversal in file update API

    Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

    Gogs Gogs gogs.io/gogs Go
  • High 8.8
    CVE-2024-44625 Public exploit EPSS 17%

    Remote Code Execution in Gogs

    Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

    gogs.io/gogs Go
  • High 7.3
    CVE-2014-8682 Public exploit EPSS 33%

    SQL Injection in Gogs

    Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/r…

    gogs.io/gogs Go