Gogs vulnerabilities
59 CVEs and advisories name Gogs as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-123012In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a…
- CVE-2026-82402Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite`
- CVE-2026-52797Gogs: Overwriting critical files results in a denial of service
- CVE-2026-52813Gogs: Path Traversal in organization name results in RCE through Git hooks
- CVE-2026-52812Gogs: LFS dedupe path leaks private repo content across tenants
- CVE-2026-52811Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym
- CVE-2026-52810Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion
- CVE-2026-52809Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
- CVE-2026-52808Gogs: Write-level collaborators can mutate admin-only repository settings via API
- CVE-2026-52816Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS
- CVE-2026-52807Gogs: DOM-based XSS via Milestone Name on New Issue Page
- CVE-2026-52805Gogs: Migration Redirect Bypass Leads to Internal Repository Theft
- CVE-2026-52806Gogs: RCE via git rebase --exec argument injection in pull request merge
- CVE-2026-52804Gogs: Privilege Escalation via Collaboration Access Mode Validation
- CVE-2026-52799Gogs: Missing Authorization in Attachment Download
- CVE-2026-52801Gogs: Ability to import local repositories via Mirror Settings
- CVE-2026-52800Gogs: CSRF Leading to Organization Owner Takeover
- CVE-2026-52802Gogs: Open Redirect via redirect_to in Gogs
- CVE-2026-52814Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)
- CVE-2026-52798Gogs: Stored XSS in `.ipynb` Preview
- CVE-2026-52796Gogs: DoS in rendering issue index pattern
- CVE-2026-47267Gogs: SSRF in webhook deliveries
- CVE-2026-25119Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers
- CVE-2026-52795Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity
- CVE-2025-64719Gogs: Denial of Service in repository/wiki file listing web pages
- CVE-2026-52815Gogs: Unauthenticated Organization Teams Information Disclosure via API
- CVE-2026-26276Gogs: DOM-based XSS via milestone selection
- CVE-2026-26196Gogs: Access tokens get exposed through URL params in API requests
- CVE-2026-26195Gogs: Stored XSS in branch and wiki views through author and committer names
- CVE-2026-26194Gogs: Release tag option injection in release deletion