Skip to main content
cve.nowby Sazabi
← Go
GoPackage

gogs.io/gogs

72 known vulnerabilities (15 critical, 27 high, 19 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
v0.13.3 (Jun 8, 2025): affected by 43 advisories
Newest unaffected release
Every release is affected by at least one advisory
Advisories
72 · 15 critical, 27 high, 19 medium, 1 low
Releases
80 since v0.2.0 (Mar 31, 2014)
Registry
pkg.go.dev
Releases read
Nov 8, 2026

Version timeline

Show all 72 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 72

  • In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a…

    Affected: all versions; fixed in 0.14.3.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: Overwriting critical files results in a denial of service

    Affected: all versions; fixed in 0.14.0.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-52813Critical 10.0

    Gogs: Path Traversal in organization name results in RCE through Git hooks

    Affected: fixed in 0.14.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: LFS dedupe path leaks private repo content across tenants

    Affected: all versions; fixed in 0.14.3.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-52811Critical 9.0

    Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

    Affected: fixed in 0.14.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion

    Affected: all versions; fixed in 0.14.3.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-52809Medium 6.8

    Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES

    Affected: fixed in 0.14.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: Write-level collaborators can mutate admin-only repository settings via API

    Affected: all versions; fixed in 0.14.3.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-52816Medium 5.4

    Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

    Affected: all versions; fixed in 0.14.3.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-52807Medium 4.8

    Gogs: DOM-based XSS via Milestone Name on New Issue Page

    Affected: fixed in 0.14.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: Migration Redirect Bypass Leads to Internal Repository Theft

    Affected: fixed in 0.14.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-52806Critical 9.9

    Gogs: RCE via git rebase --exec argument injection in pull request merge

    Affected: all versions; fixed in 0.14.3.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-52804Medium 5.5

    Gogs: Privilege Escalation via Collaboration Access Mode Validation

    Affected: fixed in 0.14.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: Missing Authorization in Attachment Download

    Affected: fixed in 0.14.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: Ability to import local repositories via Mirror Settings

    Affected: all versions; fixed in 0.14.3.

    No fix released. The latest release, v0.13.3, is still affected.

Show all 72 advisoriesShow fewer advisories

  • Gogs: CSRF Leading to Organization Owner Takeover

    Affected: fixed in 0.14.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-52802Medium 5.4

    Gogs: Open Redirect via redirect_to in Gogs

    Affected: fixed in 0.14.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-52814Medium 5.5

    Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)

    Affected: fixed in 0.14.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: Stored XSS in `.ipynb` Preview

    Affected: fixed in 0.14.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: DoS in rendering issue index pattern

    Affected: all versions; fixed in 0.14.3.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: SSRF in webhook deliveries

    Affected: all versions; fixed in 0.14.3.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers

    Affected: all versions; fixed in 0.14.3.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2025-64719Medium 4.9

    Gogs: Denial of Service in repository/wiki file listing web pages

    Affected: all versions; fixed in 0.14.3.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-52815Medium 5.5

    Gogs: Unauthenticated Organization Teams Information Disclosure via API

    Affected: fixed in 0.14.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: DOM-based XSS via milestone selection

    Affected: through 0.13.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-26196Medium 6.9

    Gogs: Access tokens get exposed through URL params in API requests

    Affected: all versions; through 0.13.3.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-26195Medium 6.9

    Gogs: Stored XSS in branch and wiki views through author and committer names

    Affected: all versions; through 0.13.3.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: Release tag option injection in release deletion

    Affected: all versions; fixed in 0.14.2.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-25921Critical 9.3

    Gogs: Cross-repository LFS object overwrite via missing content hash verification

    Affected: fixed in 0.14.2; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs: Stored XSS via data URI in issue comments

    Affected: fixed in 0.14.2; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-25229Medium 5.3

    Gogs Authorization Bypass Allows Cross-Repository Label Modification

    Affected: fixed in 0.14.0; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-25242Medium 6.9

    Gogs allows unauthenticated file uploads

    Affected: fixed in 0.14.1; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs has a Protected Branch Deletion Bypass in Web Interface

    Affected: fixed in 0.14.1; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-25120Medium 5.1

    Gogs Allows Cross-Repository Comment Deletion via DeleteComment

    Affected: fixed in 0.14.0; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update

    Affected: fixed in 0.13.4; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-23633Medium 6.5

    Gogs has arbitrary file read/write via path traversal in Git hook editing

    Affected: fixed in 0.13.4; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-23632Medium 6.5

    Gogs user can update repository content with read-only permission

    Affected: all versions; fixed in 0.13.4.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2026-22592Medium 6.5

    Gogs is Vulnerable to Denial of Service

    Affected: all versions; fixed in 0.13.4.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs Vulnerable to 2FA Bypass via Recovery Code

    Affected: from 0.11.19, fixed in 0.13.4; from 0.11.19.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2025-64111Critical 9.3

    Gogs's update .git/config file allows remote command execution

    Affected: fixed in 0.13.4; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2025-8110High 8.7 · KEV

    File overwrite in file update API in Gogs

    Affected: through 0.13.3; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2025-47943Medium 6.3

    Gogs stored XSS in PDF renderer

    Affected: fixed in 0.13.3-0.20250608224432-110117b2e5e5.

    Fixed in v0.13.3 (released Jun 8, 2025, 16 days before disclosure, the advisory names 0.13.3-0.20250608224432-110117b2e5e5, which was never published).

    The latest release, v0.13.3, is not affected.

  • CVE-2024-56731Critical 10.0

    Gogs deletion of internal files allows remote command execution

    Affected: fixed in 0.13.3.

    Fixed in v0.13.3 (released Jun 8, 2025, 16 days before disclosure).

    The latest release, v0.13.3, is not affected.

  • Gogs has a Path Traversal in file update API

    Affected: fixed in 0.13.1.

    Fixed in v0.13.1 (released Dec 22, 2024, 1 day before disclosure).

    The latest release, v0.13.3, is not affected.

  • Gogs has a Path Traversal in file editing UI

    Affected: fixed in 0.13.1.

    Fixed in v0.13.1 (released Dec 22, 2024, 1 day before disclosure).

    The latest release, v0.13.3, is not affected.

  • CVE-2022-1884Critical 10.0

    Remote Command Execution in gogs/gogs

    Affected: fixed in 0.12.8.

    Fixed in v0.12.8 (released May 31, 2022, 899 days before disclosure).

    The latest release, v0.13.3, is not affected.

  • Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

    Affected: fixed in 0.13.2; all versions.

    No fix released. The latest release, v0.13.3, is still affected.

  • Gogs through 0.13.0 allows argument injection during the tagging of a new release.

    Affected: fixed in 0.13.1.

    Fixed in v0.13.1 (released Dec 22, 2024, 171 days after disclosure).

    The latest release, v0.13.3, is not affected.

  • CVE-2024-39932Critical 9.9

    Gogs through 0.13.0 allows argument injection during the previewing of changes.

    Affected: fixed in 0.13.1.

    Fixed in v0.13.1 (released Dec 22, 2024, 171 days after disclosure).

    The latest release, v0.13.3, is not affected.

  • CVE-2024-39931Critical 9.9

    Gogs through 0.13.0 allows deletion of internal files.

    Affected: fixed in 0.13.1.

    Fixed in v0.13.1 (released Dec 22, 2024, 171 days after disclosure).

    The latest release, v0.13.3, is not affected.

  • CVE-2024-39930Critical 9.9

    The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution.

    Affected: fixed in 0.13.1.

    Fixed in v0.13.1 (released Dec 22, 2024, 171 days after disclosure).

    The latest release, v0.13.3, is not affected.

  • CVE-2022-2024Critical 9.8

    OS Command Injection in gogs/gogs

    Affected: fixed in 0.12.11.

    Fixed in v0.12.11 (released Feb 25, 2023, the day of disclosure).

    The latest release, v0.13.3, is not affected.

  • CVE-2022-32174Critical 9.0

    Gogs - XSS

    Affected: from 0.6.5; from 0.6.5, through 0.12.10.

    No fix released. The latest release, v0.13.3, is still affected.

  • CVE-2022-1986Critical 10.0

    OS Command Injection in gogs/gogs

    Affected: fixed in 0.12.9.

    Fixed in v0.12.9 (released Jun 7, 2022, 2 days before disclosure).

    The latest release, v0.13.3, is not affected.

  • CVE-2022-31038Medium 5.4

    XSS vulnerability in repository issue list in Gogs

    Affected: fixed in 0.12.9.

    Fixed in v0.12.9 (released Jun 7, 2022, 1 day before disclosure).

    The latest release, v0.13.3, is not affected.

  • Path Traversal in gogs/gogs

    Affected: fixed in 0.12.9.

    Fixed in v0.12.9 (released Jun 7, 2022, 1 day before disclosure).

    The latest release, v0.13.3, is not affected.

  • CVE-2022-1992Critical 10.0

    Path Traversal in gogs/gogs

    Affected: fixed in 0.12.9.

    Fixed in v0.12.9 (released Jun 7, 2022, 1 day before disclosure).

    The latest release, v0.13.3, is not affected.

  • Server-Side Request Forgery (SSRF) in gogs/gogs

    Affected: fixed in 0.12.8.

    Fixed in v0.12.8 (released May 31, 2022, 1 day before disclosure).

    The latest release, v0.13.3, is not affected.

  • Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely.

    Affected: fixed in 0.12.8.

    Fixed in v0.12.8 (released May 31, 2022, the day of disclosure).

    The latest release, v0.13.3, is not affected.

  • Stored xss bug in gogs/gogs

    Affected: fixed in 0.12.7.

    Fixed in v0.12.7 (released May 5, 2022, the day of disclosure).

    The latest release, v0.13.3, is not affected.

  • CVE-2022-0415Critical 9.9

    Remote Command Execution in uploading repository file in gogs/gogs

    Affected: fixed in 0.12.6.

    Fixed in v0.12.6 (released Mar 19, 2022, 2 days before disclosure).

    The latest release, v0.13.3, is not affected.

  • CVE-2022-0870Medium 5.0

    Server-Side Request Forgery (SSRF) in gogs/gogs

    Affected: fixed in 0.12.5.

    Fixed in v0.12.5 (released Mar 11, 2022, the day of disclosure).

    The latest release, v0.13.3, is not affected.

  • Missing Authorization in gogs/gogs

    Affected: fixed in 0.12.5.

    Fixed in v0.12.5 (released Mar 11, 2022, the day of disclosure).

    The latest release, v0.13.3, is not affected.

  • In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.

    Affected: fixed in 0.12.0.

    Fixed in v0.12.0 (released Aug 22, 2020, 62 days after disclosure).

    The latest release, v0.13.3, is not affected.

  • routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.

    Affected: fixed in 0.11.91.

    Fixed in v0.11.91 (released Aug 12, 2019, 10 days after disclosure).

    The latest release, v0.13.3, is not affected.

  • In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a…

    Affected: fixed in 0.11.80-0.20181218063808-ff93d9dbda5c.

    Fixed in v0.11.86 (released Jan 31, 2019, 42 days after disclosure, the advisory names 0.11.80-0.20181218063808-ff93d9dbda5c, which was never published).

    The latest release, v0.13.3, is not affected.

  • In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet…

    Affected: fixed in 0.12.0.

    Fixed in v0.12.0 (released Aug 22, 2020, 708 days after disclosure).

    The latest release, v0.13.3, is not affected.

  • An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.

    Affected: fixed in 0.12.0.

    Fixed in v0.12.0 (released Aug 22, 2020, 745 days after disclosure).

    The latest release, v0.13.3, is not affected.

  • Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing…

    Affected: fixed in 0.12.0.

    Fixed in v0.12.0 (released Aug 22, 2020, 745 days after disclosure).

    The latest release, v0.13.3, is not affected.

  • Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote…

    Affected: from 0.3.1, fixed in 0.5.8.

    Fixed in v0.5.8 (released Nov 19, 2014, 2 days before disclosure).

    The latest release, v0.13.3, is not affected.

  • Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to…

    Affected: from 0.3.1, fixed in 0.5.8.

    Fixed in v0.5.8 (released Nov 19, 2014, 2 days before disclosure).

    The latest release, v0.13.3, is not affected.

  • SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before…

    Affected: from 0.3.1, fixed in 0.5.8.

    Fixed in v0.5.8 (released Nov 19, 2014, 2 days before disclosure).

    The latest release, v0.13.3, is not affected.