Skip to content
OpenAdvisories

Vendor

Gogs

59 known vulnerabilities.

Products

Gogs 49 gogs/gogs 10
All Critical High Medium Low Exploited only Public exploit

59 results · Feed

  • High 7.7
    CVE-2025-64175

    Gogs Vulnerable to 2FA Bypass via Recovery Code

    Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use any unused recover…

    Gogs Gogs gogs.io/gogs Go
  • Critical 9.3
    CVE-2025-64111

    Gogs's update .git/config file allows remote command execution

    Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command execution. This issue has been patched in versi…

    Gogs Gogs gogs.io/gogs Go
  • High 8.7
    CVE-2025-8110 Exploited Public exploit Scanner template EPSS 80%

    File overwrite in file update API in Gogs

    Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

    Gogs Gogs gogs.io/gogs Go
    KEV Jan 12, 2026
  • Medium 6.3
    CVE-2025-47943

    Gogs stored XSS in PDF renderer

    Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usa…

    Gogs Gogs gogs.io/gogs github.com/gogs/gogs Go
  • Critical 10.0
    CVE-2024-56731

    Gogs deletion of internal files allows remote command execution

    Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute …

    Gogs Gogs gogs.io/gogs Go
  • High 8.7
    CVE-2024-55947 Public exploit EPSS 78%

    Gogs has a Path Traversal in file update API

    Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

    Gogs Gogs gogs.io/gogs Go
  • High 8.7
    CVE-2024-54148

    Gogs has a Path Traversal in file editing UI

    Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

    Gogs Gogs gogs.io/gogs Go
  • Critical 10.0
    CVE-2022-1884

    Remote Command Execution in gogs/gogs

    A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to up…

    Gogs gogs/gogs gogs.io/gogs Go
  • Critical 9.8
    CVE-2022-2024 EPSS 98%

    OS Command Injection in gogs/gogs

    OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

    Gogs gogs/gogs gogs.io/gogs Go
  • Critical 9.0
    CVE-2022-32174 EPSS 58%

    Gogs - XSS

    In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.

    Gogs Gogs gogs.io/gogs gogs Alpine Go
  • Critical 10.0
    CVE-2022-1986

    OS Command Injection in gogs/gogs

    OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.

    Gogs gogs/gogs gogs.io/gogs Go
  • Medium 5.4
    CVE-2022-31038

    XSS vulnerability in repository issue list in Gogs

    Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from users, which leads to an XSS vulnerability when directly displayed in the issue list. This issue has been resolved in commi…

    Gogs Gogs gogs.io/gogs Go
  • High 8.1
    CVE-2022-1993 EPSS 37%

    Path Traversal in gogs/gogs

    Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.

    Gogs gogs/gogs gogs.io/gogs Go
  • Critical 10.0
    CVE-2022-1992

    Path Traversal in gogs/gogs

    Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.

    Gogs gogs/gogs gogs.io/gogs Go
  • High 8.3
    CVE-2022-1285

    Server-Side Request Forgery (SSRF) in gogs/gogs

    Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8.

    Gogs gogs/gogs gogs.io/gogs gogs Alpine Go
  • High 7.3
    CVE-2022-1464

    Stored xss bug in gogs/gogs

    Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .

    Gogs gogs/gogs gogs.io/gogs gogs Alpine Go
  • Critical 9.9
    CVE-2022-0415 Scanner template EPSS 66%

    Remote Command Execution in uploading repository file in gogs/gogs

    Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.

    Gogs gogs/gogs gogs.io/gogs golang-github-gogits-go-gogs-client Ubuntu Go
  • Medium 5.0
    CVE-2022-0870 Scanner template

    Server-Side Request Forgery (SSRF) in gogs/gogs

    Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.

    Gogs gogs/gogs gogs.io/gogs gogs Alpine Go
  • High 8.2
    CVE-2022-0871

    Missing Authorization in gogs/gogs

    Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.

    Gogs gogs/gogs gogs.io/gogs gogs Alpine Go