# gogs.io/gogs (Go) vulnerabilities

72 known vulnerabilities (15 critical, 27 high, 19 medium, 1 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: v0.13.3 (Jun 8, 2025): affected by 43 advisories
- Newest unaffected release: Every release is affected by at least one advisory
- Releases: 80 since v0.2.0 (Mar 31, 2014)
- Registry: https://pkg.go.dev/gogs.io/gogs
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-123012: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52797: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52813: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52812: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52811: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52810: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52809: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52808: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52816: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52807: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52805: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52806: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52804: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52799: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52801: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52800: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52802: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52814: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52798: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52796: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-47267: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-25119: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2025-64719: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-52815: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-26276: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-26196: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-26195: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-26194: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-25921: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-26022: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-25229: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-25242: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-25232: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-25120: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-24135: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-23633: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-23632: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2026-22592: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2025-64175: v0.11.19 to v0.13.3 (through the newest release)
- CVE-2025-64111: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2025-8110: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2025-47943: v0.2.0 to v0.13.2 (v0.13.3-rc.1 is outside it)
- CVE-2024-56731: v0.2.0 to v0.13.3-rc.1 (v0.13.3 is outside it)
- CVE-2024-55947: v0.2.0 to v0.13.1-rc.1 (v0.13.1 is outside it)
- CVE-2024-54148: v0.2.0 to v0.13.1-rc.1 (v0.13.1 is outside it)
- CVE-2022-1884: v0.2.0 to v0.12.8-rc.1 (v0.12.8 is outside it)
- CVE-2024-44625: v0.2.0 to v0.13.3 (through the newest release)
- CVE-2024-39933: v0.2.0 to v0.13.1-rc.1 (v0.13.1 is outside it)
- CVE-2024-39932: v0.2.0 to v0.13.1-rc.1 (v0.13.1 is outside it)
- CVE-2024-39931: v0.2.0 to v0.13.1-rc.1 (v0.13.1 is outside it)
- CVE-2024-39930: v0.2.0 to v0.13.1-rc.1 (v0.13.1 is outside it)
- CVE-2022-2024: v0.2.0 to v0.12.11-rc.1 (v0.12.11 is outside it)
- CVE-2022-32174: v0.6.5 to v0.13.3 (through the newest release)
- CVE-2022-1986: v0.2.0 to v0.12.9-rc.1 (v0.12.9 is outside it)
- CVE-2022-31038: v0.2.0 to v0.12.9-rc.1 (v0.12.9 is outside it)
- CVE-2022-1993: v0.2.0 to v0.12.9-rc.1 (v0.12.9 is outside it)
- CVE-2022-1992: v0.2.0 to v0.12.9-rc.1 (v0.12.9 is outside it)
- CVE-2022-1285: v0.2.0 to v0.12.8-rc.1 (v0.12.8 is outside it)
- CVE-2021-32546: v0.2.0 to v0.12.8-rc.1 (v0.12.8 is outside it)
- CVE-2022-1464: v0.2.0 to v0.12.7-rc.1 (v0.12.7 is outside it)
- CVE-2022-0415: v0.2.0 to v0.12.6-rc.1 (v0.12.6 is outside it)
- CVE-2022-0870: v0.2.0 to v0.12.5-rc.1 (v0.12.5 is outside it)
- CVE-2022-0871: v0.2.0 to v0.12.5-rc.1 (v0.12.5 is outside it)
- CVE-2020-14958: v0.2.0 to v0.11.91 (v0.12.0 is outside it)
- CVE-2019-14544: v0.2.0 to v0.11.86 (v0.11.91 is outside it)
- CVE-2018-20303: v0.2.0 to v0.11.79 (v0.11.86 is outside it)
- CVE-2018-17031: v0.2.0 to v0.11.91 (v0.12.0 is outside it)
- CVE-2018-15192: v0.2.0 to v0.11.91 (v0.12.0 is outside it)
- CVE-2018-15178: v0.2.0 to v0.11.91 (v0.12.0 is outside it)
- CVE-2014-8683: v0.3.1 to v0.5.5 (v0.5.8 is outside it)
- CVE-2014-8682: v0.3.1 to v0.5.5 (v0.5.8 is outside it)
- CVE-2014-8681: v0.3.1 to v0.5.5 (v0.5.8 is outside it)

## Advisories (72)

### [CVE-2026-123012](https://cve.now/CVE-2026-123012): In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a…

- Severity: High 7.1
- Published: Nov 5, 2026
- Affected: all versions; fixed in 0.14.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52797](https://cve.now/CVE-2026-52797): Gogs: Overwriting critical files results in a denial of service

- Severity: High 8.5
- Published: Jun 24, 2026
- Affected: all versions; fixed in 0.14.0.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52813](https://cve.now/CVE-2026-52813): Gogs: Path Traversal in organization name results in RCE through Git hooks

- Severity: Critical 10.0
- Published: Jun 24, 2026
- Affected: fixed in 0.14.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52812](https://cve.now/CVE-2026-52812): Gogs: LFS dedupe path leaks private repo content across tenants

- Severity: High 7.1
- Published: Jun 24, 2026
- Affected: all versions; fixed in 0.14.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52811](https://cve.now/CVE-2026-52811): Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

- Severity: Critical 9.0
- Published: Jun 24, 2026
- Affected: fixed in 0.14.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52810](https://cve.now/CVE-2026-52810): Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion

- Severity: High 7.1
- Published: Jun 24, 2026
- Affected: all versions; fixed in 0.14.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52809](https://cve.now/CVE-2026-52809): Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET\_PASSWORD\_CODE\_LIVES

- Severity: Medium 6.8
- Published: Jun 24, 2026
- Affected: fixed in 0.14.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52808](https://cve.now/CVE-2026-52808): Gogs: Write-level collaborators can mutate admin-only repository settings via API

- Severity: High 7.1
- Published: Jun 24, 2026
- Affected: all versions; fixed in 0.14.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52816](https://cve.now/CVE-2026-52816): Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

- Severity: Medium 5.4
- Published: Jun 24, 2026
- Affected: all versions; fixed in 0.14.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52807](https://cve.now/CVE-2026-52807): Gogs: DOM-based XSS via Milestone Name on New Issue Page

- Severity: Medium 4.8
- Published: Jun 24, 2026
- Affected: fixed in 0.14.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52805](https://cve.now/CVE-2026-52805): Gogs: Migration Redirect Bypass Leads to Internal Repository Theft

- Severity: High 8.7
- Published: Jun 24, 2026
- Affected: fixed in 0.14.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52806](https://cve.now/CVE-2026-52806): Gogs: RCE via git rebase --exec argument injection in pull request merge

- Severity: Critical 9.9
- Published: Jun 24, 2026
- Affected: all versions; fixed in 0.14.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52804](https://cve.now/CVE-2026-52804): Gogs: Privilege Escalation via Collaboration Access Mode Validation

- Severity: Medium 5.5
- Published: Jun 24, 2026
- Affected: fixed in 0.14.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52799](https://cve.now/CVE-2026-52799): Gogs: Missing Authorization in Attachment Download

- Severity: High 7.5
- Published: Jun 24, 2026
- Affected: fixed in 0.14.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52801](https://cve.now/CVE-2026-52801): Gogs: Ability to import local repositories via Mirror Settings

- Severity: High 8.1
- Published: Jun 24, 2026
- Affected: all versions; fixed in 0.14.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52800](https://cve.now/CVE-2026-52800): Gogs: CSRF Leading to Organization Owner Takeover

- Severity: High 8.8
- Published: Jun 24, 2026
- Affected: fixed in 0.14.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52802](https://cve.now/CVE-2026-52802): Gogs: Open Redirect via redirect\_to in Gogs

- Severity: Medium 5.4
- Published: Jun 24, 2026
- Affected: fixed in 0.14.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52814](https://cve.now/CVE-2026-52814): Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)

- Severity: Medium 5.5
- Published: Jun 24, 2026
- Affected: fixed in 0.14.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52798](https://cve.now/CVE-2026-52798): Gogs: Stored XSS in \`.ipynb\` Preview

- Severity: High 8.9
- Published: Jun 24, 2026
- Affected: fixed in 0.14.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52796](https://cve.now/CVE-2026-52796): Gogs: DoS in rendering issue index pattern

- Severity: Low 3.5
- Published: Jun 24, 2026
- Affected: all versions; fixed in 0.14.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-47267](https://cve.now/CVE-2026-47267): Gogs: SSRF in webhook deliveries

- Severity: High 8.3
- Published: Jun 24, 2026
- Affected: all versions; fixed in 0.14.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-25119](https://cve.now/CVE-2026-25119): Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers

- Severity: High 7.7
- Published: Jun 24, 2026
- Affected: all versions; fixed in 0.14.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2025-64719](https://cve.now/CVE-2025-64719): Gogs: Denial of Service in repository/wiki file listing web pages

- Severity: Medium 4.9
- Published: Jun 24, 2026
- Affected: all versions; fixed in 0.14.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-52815](https://cve.now/CVE-2026-52815): Gogs: Unauthenticated Organization Teams Information Disclosure via API

- Severity: Medium 5.5
- Published: Jun 24, 2026
- Affected: fixed in 0.14.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-26276](https://cve.now/CVE-2026-26276): Gogs: DOM-based XSS via milestone selection

- Severity: High 7.3
- Published: Mar 5, 2026
- Affected: through 0.13.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-26196](https://cve.now/CVE-2026-26196): Gogs: Access tokens get exposed through URL params in API requests

- Severity: Medium 6.9
- Published: Mar 5, 2026
- Affected: all versions; through 0.13.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-26195](https://cve.now/CVE-2026-26195): Gogs: Stored XSS in branch and wiki views through author and committer names

- Severity: Medium 6.9
- Published: Mar 5, 2026
- Affected: all versions; through 0.13.3.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-26194](https://cve.now/CVE-2026-26194): Gogs: Release tag option injection in release deletion

- Severity: High 8.8
- Published: Mar 5, 2026
- Affected: all versions; fixed in 0.14.2.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-25921](https://cve.now/CVE-2026-25921): Gogs: Cross-repository LFS object overwrite via missing content hash verification

- Severity: Critical 9.3
- Published: Mar 5, 2026
- Affected: fixed in 0.14.2; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-26022](https://cve.now/CVE-2026-26022): Gogs: Stored XSS via data URI in issue comments

- Severity: High 8.7
- Published: Mar 5, 2026
- Affected: fixed in 0.14.2; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-25229](https://cve.now/CVE-2026-25229): Gogs Authorization Bypass Allows Cross-Repository Label Modification

- Severity: Medium 5.3
- Published: Feb 19, 2026
- Affected: fixed in 0.14.0; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-25242](https://cve.now/CVE-2026-25242): Gogs allows unauthenticated file uploads

- Severity: Medium 6.9
- Published: Feb 19, 2026
- Affected: fixed in 0.14.1; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-25232](https://cve.now/CVE-2026-25232): Gogs has a Protected Branch Deletion Bypass in Web Interface

- Severity: High 7.1
- Published: Feb 19, 2026
- Affected: fixed in 0.14.1; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-25120](https://cve.now/CVE-2026-25120): Gogs Allows Cross-Repository Comment Deletion via DeleteComment

- Severity: Medium 5.1
- Published: Feb 19, 2026
- Affected: fixed in 0.14.0; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-24135](https://cve.now/CVE-2026-24135): Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update

- Severity: High 7.2
- Published: Feb 6, 2026
- Affected: fixed in 0.13.4; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-23633](https://cve.now/CVE-2026-23633): Gogs has arbitrary file read/write via path traversal in Git hook editing

- Severity: Medium 6.5
- Published: Feb 6, 2026
- Affected: fixed in 0.13.4; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-23632](https://cve.now/CVE-2026-23632): Gogs user can update repository content with read-only permission

- Severity: Medium 6.5
- Published: Feb 6, 2026
- Affected: all versions; fixed in 0.13.4.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2026-22592](https://cve.now/CVE-2026-22592): Gogs is Vulnerable to Denial of Service

- Severity: Medium 6.5
- Published: Feb 6, 2026
- Affected: all versions; fixed in 0.13.4.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2025-64175](https://cve.now/CVE-2025-64175): Gogs Vulnerable to 2FA Bypass via Recovery Code

- Severity: High 7.7
- Published: Feb 6, 2026
- Affected: from 0.11.19, fixed in 0.13.4; from 0.11.19.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2025-64111](https://cve.now/CVE-2025-64111): Gogs's update .git/config file allows remote command execution

- Severity: Critical 9.3
- Published: Feb 6, 2026
- Affected: fixed in 0.13.4; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2025-8110](https://cve.now/CVE-2025-8110): File overwrite in file update API in Gogs

- Severity: High 8.7 · KEV
- Published: Dec 10, 2025
- Affected: through 0.13.3; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2025-47943](https://cve.now/CVE-2025-47943): Gogs stored XSS in PDF renderer

- Severity: Medium 6.3
- Published: Jun 24, 2025
- Affected: fixed in 0.13.3-0.20250608224432-110117b2e5e5.
- Fixed in v0.13.3 (released Jun 8, 2025, 16 days before disclosure, the advisory names 0.13.3-0.20250608224432-110117b2e5e5, which was never published).
- The latest release, v0.13.3, is not affected.

### [CVE-2024-56731](https://cve.now/CVE-2024-56731): Gogs deletion of internal files allows remote command execution

- Severity: Critical 10.0
- Published: Jun 24, 2025
- Affected: fixed in 0.13.3.
- Fixed in v0.13.3 (released Jun 8, 2025, 16 days before disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2024-55947](https://cve.now/CVE-2024-55947): Gogs has a Path Traversal in file update API

- Severity: High 8.7
- Published: Dec 23, 2024
- Affected: fixed in 0.13.1.
- Fixed in v0.13.1 (released Dec 22, 2024, 1 day before disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2024-54148](https://cve.now/CVE-2024-54148): Gogs has a Path Traversal in file editing UI

- Severity: High 8.7
- Published: Dec 23, 2024
- Affected: fixed in 0.13.1.
- Fixed in v0.13.1 (released Dec 22, 2024, 1 day before disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2022-1884](https://cve.now/CVE-2022-1884): Remote Command Execution in gogs/gogs

- Severity: Critical 10.0
- Published: Nov 15, 2024
- Affected: fixed in 0.12.8.
- Fixed in v0.12.8 (released May 31, 2022, 899 days before disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2024-44625](https://cve.now/CVE-2024-44625): Gogs \<=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

- Severity: High 8.8
- Published: Nov 15, 2024
- Affected: fixed in 0.13.2; all versions.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2024-39933](https://cve.now/CVE-2024-39933): Gogs through 0.13.0 allows argument injection during the tagging of a new release.

- Severity: High 7.7
- Published: Jul 4, 2024
- Affected: fixed in 0.13.1.
- Fixed in v0.13.1 (released Dec 22, 2024, 171 days after disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2024-39932](https://cve.now/CVE-2024-39932): Gogs through 0.13.0 allows argument injection during the previewing of changes.

- Severity: Critical 9.9
- Published: Jul 4, 2024
- Affected: fixed in 0.13.1.
- Fixed in v0.13.1 (released Dec 22, 2024, 171 days after disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2024-39931](https://cve.now/CVE-2024-39931): Gogs through 0.13.0 allows deletion of internal files.

- Severity: Critical 9.9
- Published: Jul 4, 2024
- Affected: fixed in 0.13.1.
- Fixed in v0.13.1 (released Dec 22, 2024, 171 days after disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2024-39930](https://cve.now/CVE-2024-39930): The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution.

- Severity: Critical 9.9
- Published: Jul 4, 2024
- Affected: fixed in 0.13.1.
- Fixed in v0.13.1 (released Dec 22, 2024, 171 days after disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2022-2024](https://cve.now/CVE-2022-2024): OS Command Injection in gogs/gogs

- Severity: Critical 9.8
- Published: Feb 25, 2023
- Affected: fixed in 0.12.11.
- Fixed in v0.12.11 (released Feb 25, 2023, the day of disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2022-32174](https://cve.now/CVE-2022-32174): Gogs - XSS

- Severity: Critical 9.0
- Published: Oct 11, 2022
- Affected: from 0.6.5; from 0.6.5, through 0.12.10.
- No fix released. The latest release, v0.13.3, is still affected.

### [CVE-2022-1986](https://cve.now/CVE-2022-1986): OS Command Injection in gogs/gogs

- Severity: Critical 10.0
- Published: Jun 9, 2022
- Affected: fixed in 0.12.9.
- Fixed in v0.12.9 (released Jun 7, 2022, 2 days before disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2022-31038](https://cve.now/CVE-2022-31038): XSS vulnerability in repository issue list in Gogs

- Severity: Medium 5.4
- Published: Jun 8, 2022
- Affected: fixed in 0.12.9.
- Fixed in v0.12.9 (released Jun 7, 2022, 1 day before disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2022-1993](https://cve.now/CVE-2022-1993): Path Traversal in gogs/gogs

- Severity: High 8.1
- Published: Jun 8, 2022
- Affected: fixed in 0.12.9.
- Fixed in v0.12.9 (released Jun 7, 2022, 1 day before disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2022-1992](https://cve.now/CVE-2022-1992): Path Traversal in gogs/gogs

- Severity: Critical 10.0
- Published: Jun 8, 2022
- Affected: fixed in 0.12.9.
- Fixed in v0.12.9 (released Jun 7, 2022, 1 day before disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2022-1285](https://cve.now/CVE-2022-1285): Server-Side Request Forgery (SSRF) in gogs/gogs

- Severity: High 8.3
- Published: Jun 1, 2022
- Affected: fixed in 0.12.8.
- Fixed in v0.12.8 (released May 31, 2022, 1 day before disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2021-32546](https://cve.now/CVE-2021-32546): Missing input validation in internal/db/repo\_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely.

- Severity: Unrated
- Published: May 31, 2022
- Affected: fixed in 0.12.8.
- Fixed in v0.12.8 (released May 31, 2022, the day of disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2022-1464](https://cve.now/CVE-2022-1464): Stored xss bug in gogs/gogs

- Severity: High 7.3
- Published: May 5, 2022
- Affected: fixed in 0.12.7.
- Fixed in v0.12.7 (released May 5, 2022, the day of disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2022-0415](https://cve.now/CVE-2022-0415): Remote Command Execution in uploading repository file in gogs/gogs

- Severity: Critical 9.9
- Published: Mar 21, 2022
- Affected: fixed in 0.12.6.
- Fixed in v0.12.6 (released Mar 19, 2022, 2 days before disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2022-0870](https://cve.now/CVE-2022-0870): Server-Side Request Forgery (SSRF) in gogs/gogs

- Severity: Medium 5.0
- Published: Mar 11, 2022
- Affected: fixed in 0.12.5.
- Fixed in v0.12.5 (released Mar 11, 2022, the day of disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2022-0871](https://cve.now/CVE-2022-0871): Missing Authorization in gogs/gogs

- Severity: High 8.2
- Published: Mar 11, 2022
- Affected: fixed in 0.12.5.
- Fixed in v0.12.5 (released Mar 11, 2022, the day of disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2020-14958](https://cve.now/CVE-2020-14958): In Gogs 0.11.91, MakeEmailPrimary in models/user\_mail.go lacks a "not the owner of the email" check.

- Severity: Unrated
- Published: Jun 21, 2020
- Affected: fixed in 0.12.0.
- Fixed in v0.12.0 (released Aug 22, 2020, 62 days after disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2019-14544](https://cve.now/CVE-2019-14544): routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.

- Severity: Unrated
- Published: Aug 2, 2019
- Affected: fixed in 0.11.91.
- Fixed in v0.11.91 (released Aug 12, 2019, 10 days after disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2018-20303](https://cve.now/CVE-2018-20303): In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a…

- Severity: Unrated
- Published: Dec 20, 2018
- Affected: fixed in 0.11.80-0.20181218063808-ff93d9dbda5c.
- Fixed in v0.11.86 (released Jan 31, 2019, 42 days after disclosure, the advisory names 0.11.80-0.20181218063808-ff93d9dbda5c, which was never published).
- The latest release, v0.13.3, is not affected.

### [CVE-2018-17031](https://cve.now/CVE-2018-17031): In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet…

- Severity: Unrated
- Published: Sep 14, 2018
- Affected: fixed in 0.12.0.
- Fixed in v0.12.0 (released Aug 22, 2020, 708 days after disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2018-15192](https://cve.now/CVE-2018-15192): An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services.

- Severity: Unrated
- Published: Aug 8, 2018
- Affected: fixed in 0.12.0.
- Fixed in v0.12.0 (released Aug 22, 2020, 745 days after disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2018-15178](https://cve.now/CVE-2018-15178): Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing…

- Severity: Unrated
- Published: Aug 8, 2018
- Affected: fixed in 0.12.0.
- Fixed in v0.12.0 (released Aug 22, 2020, 745 days after disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2014-8683](https://cve.now/CVE-2014-8683): Cross-site scripting (XSS) vulnerability in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.8 allows remote…

- Severity: Unrated
- Published: Nov 21, 2014
- Affected: from 0.3.1, fixed in 0.5.8.
- Fixed in v0.5.8 (released Nov 19, 2014, 2 days before disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2014-8682](https://cve.now/CVE-2014-8682): Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to…

- Severity: Unrated
- Published: Nov 21, 2014
- Affected: from 0.3.1, fixed in 0.5.8.
- Fixed in v0.5.8 (released Nov 19, 2014, 2 days before disclosure).
- The latest release, v0.13.3, is not affected.

### [CVE-2014-8681](https://cve.now/CVE-2014-8681): SQL injection vulnerability in the GetIssues function in models/issue.go in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.6.x before…

- Severity: Unrated
- Published: Nov 21, 2014
- Affected: from 0.3.1, fixed in 0.5.8.
- Fixed in v0.5.8 (released Nov 19, 2014, 2 days before disclosure).
- The latest release, v0.13.3, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/go/gogs.io/gogs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.