Skip to content
OpenAdvisories

Vendor

Gogs

59 known vulnerabilities.

Products

Gogs 49 gogs/gogs 10
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-52813 Public exploit

    Gogs: Path Traversal in organization name results in RCE through Git hooks

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrievin…

    Gogs Gogs gogs.io/gogs Go
  • Critical 9.0
    CVE-2026-52811

    Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only on the leaf of the upload target (osx.IsSymlink(targetPath)). The siblings UpdateRepoFile, DeleteRepoFile, and GetDiffPreview use hasSymlin…

    Gogs Gogs gogs.io/gogs Go
  • Critical 9.9
    CVE-2026-52806 Public exploit Scanner template

    Gogs: RCE via git rebase --exec argument injection in pull request merge

    Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git reb…

    Gogs Gogs gogs.io/gogs Go
  • Critical 9.3
    CVE-2026-25921

    Gogs: Cross-repository LFS object overwrite via missing content hash verification

    Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patc…

    Gogs Gogs gogs.io/gogs Go
  • Critical 9.3
    CVE-2025-64111

    Gogs's update .git/config file allows remote command execution

    Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command execution. This issue has been patched in versi…

    Gogs Gogs gogs.io/gogs Go
  • Critical 10.0
    CVE-2024-56731

    Gogs deletion of internal files allows remote command execution

    Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute …

    Gogs Gogs gogs.io/gogs Go
  • Critical 10.0
    CVE-2022-1884

    Remote Command Execution in gogs/gogs

    A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to up…

    Gogs gogs/gogs gogs.io/gogs Go
  • Critical 9.8
    CVE-2022-2024 EPSS 98%

    OS Command Injection in gogs/gogs

    OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

    Gogs gogs/gogs gogs.io/gogs Go
  • Critical 9.0
    CVE-2022-32174 EPSS 58%

    Gogs - XSS

    In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.

    Gogs Gogs gogs.io/gogs gogs Alpine Go
  • Critical 10.0
    CVE-2022-1986

    OS Command Injection in gogs/gogs

    OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.

    Gogs gogs/gogs gogs.io/gogs Go
  • Critical 10.0
    CVE-2022-1992

    Path Traversal in gogs/gogs

    Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.

    Gogs gogs/gogs gogs.io/gogs Go
  • Critical 9.9
    CVE-2022-0415 Scanner template EPSS 66%

    Remote Command Execution in uploading repository file in gogs/gogs

    Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.

    Gogs gogs/gogs gogs.io/gogs golang-github-gogits-go-gogs-client Ubuntu Go