# cve.now: Gogs

The newest entries naming Gogs as an affected vendor (up to 200), of 59 in all, 1 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-123012](https://cve.now/CVE-2026-123012.md): In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a… (CVSS 7.1)
- [CVE-2026-82402](https://cve.now/CVE-2026-82402.md): Gogs: Open Redirect in /redirect endpoint via backslash bypass in \`IsSameSite\` (CVSS 5.3)
- [CVE-2026-52797](https://cve.now/CVE-2026-52797.md): Gogs: Overwriting critical files results in a denial of service (CVSS 8.5)
- [CVE-2026-52813](https://cve.now/CVE-2026-52813.md): Gogs: Path Traversal in organization name results in RCE through Git hooks (CVSS 10.0)
- [CVE-2026-52812](https://cve.now/CVE-2026-52812.md): Gogs: LFS dedupe path leaks private repo content across tenants (CVSS 7.1)
- [CVE-2026-52811](https://cve.now/CVE-2026-52811.md): Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym (CVSS 9.0)
- [CVE-2026-52810](https://cve.now/CVE-2026-52810.md): Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion (CVSS 7.1)
- [CVE-2026-52809](https://cve.now/CVE-2026-52809.md): Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET\_PASSWORD\_CODE\_LIVES (CVSS 6.8)
- [CVE-2026-52808](https://cve.now/CVE-2026-52808.md): Gogs: Write-level collaborators can mutate admin-only repository settings via API (CVSS 7.1)
- [CVE-2026-52816](https://cve.now/CVE-2026-52816.md): Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS (CVSS 5.4)
- [CVE-2026-52807](https://cve.now/CVE-2026-52807.md): Gogs: DOM-based XSS via Milestone Name on New Issue Page (CVSS 4.8)
- [CVE-2026-52805](https://cve.now/CVE-2026-52805.md): Gogs: Migration Redirect Bypass Leads to Internal Repository Theft (CVSS 8.7)
- [CVE-2026-52806](https://cve.now/CVE-2026-52806.md): Gogs: RCE via git rebase --exec argument injection in pull request merge (CVSS 9.9)
- [CVE-2026-52804](https://cve.now/CVE-2026-52804.md): Gogs: Privilege Escalation via Collaboration Access Mode Validation (CVSS 5.5)
- [CVE-2026-52799](https://cve.now/CVE-2026-52799.md): Gogs: Missing Authorization in Attachment Download (CVSS 7.5)
- [CVE-2026-52801](https://cve.now/CVE-2026-52801.md): Gogs: Ability to import local repositories via Mirror Settings (CVSS 8.1)
- [CVE-2026-52800](https://cve.now/CVE-2026-52800.md): Gogs: CSRF Leading to Organization Owner Takeover (CVSS 8.8)
- [CVE-2026-52802](https://cve.now/CVE-2026-52802.md): Gogs: Open Redirect via redirect\_to in Gogs (CVSS 5.4)
- [CVE-2026-52814](https://cve.now/CVE-2026-52814.md): Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) (CVSS 5.5)
- [CVE-2026-52798](https://cve.now/CVE-2026-52798.md): Gogs: Stored XSS in \`.ipynb\` Preview (CVSS 8.9)
- [CVE-2026-52796](https://cve.now/CVE-2026-52796.md): Gogs: DoS in rendering issue index pattern (CVSS 3.5)
- [CVE-2026-47267](https://cve.now/CVE-2026-47267.md): Gogs: SSRF in webhook deliveries (CVSS 8.3)
- [CVE-2026-25119](https://cve.now/CVE-2026-25119.md): Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers (CVSS 7.7)
- [CVE-2026-52795](https://cve.now/CVE-2026-52795.md): Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity (CVSS 4.3)
- [CVE-2025-64719](https://cve.now/CVE-2025-64719.md): Gogs: Denial of Service in repository/wiki file listing web pages (CVSS 4.9)
- [CVE-2026-52815](https://cve.now/CVE-2026-52815.md): Gogs: Unauthenticated Organization Teams Information Disclosure via API (CVSS 5.5)
- [CVE-2026-26276](https://cve.now/CVE-2026-26276.md): Gogs: DOM-based XSS via milestone selection (CVSS 7.3)
- [CVE-2026-26196](https://cve.now/CVE-2026-26196.md): Gogs: Access tokens get exposed through URL params in API requests (CVSS 6.9)
- [CVE-2026-26195](https://cve.now/CVE-2026-26195.md): Gogs: Stored XSS in branch and wiki views through author and committer names (CVSS 6.9)
- [CVE-2026-26194](https://cve.now/CVE-2026-26194.md): Gogs: Release tag option injection in release deletion (CVSS 8.8)
- [CVE-2026-25921](https://cve.now/CVE-2026-25921.md): Gogs: Cross-repository LFS object overwrite via missing content hash verification (CVSS 9.3)
- [CVE-2026-26022](https://cve.now/CVE-2026-26022.md): Gogs: Stored XSS via data URI in issue comments (CVSS 8.7)
- [CVE-2026-25229](https://cve.now/CVE-2026-25229.md): Gogs Authorization Bypass Allows Cross-Repository Label Modification (CVSS 5.3)
- [CVE-2026-25242](https://cve.now/CVE-2026-25242.md): Gogs allows unauthenticated file uploads (CVSS 6.9)
- [CVE-2026-25232](https://cve.now/CVE-2026-25232.md): Gogs has a Protected Branch Deletion Bypass in Web Interface (CVSS 7.1)
- [CVE-2026-25120](https://cve.now/CVE-2026-25120.md): Gogs Allows Cross-Repository Comment Deletion via DeleteComment (CVSS 5.1)
- [CVE-2026-24135](https://cve.now/CVE-2026-24135.md): Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update (CVSS 7.2)
- [CVE-2026-23633](https://cve.now/CVE-2026-23633.md): Gogs has arbitrary file read/write via path traversal in Git hook editing (CVSS 6.5)
- [CVE-2026-23632](https://cve.now/CVE-2026-23632.md): Gogs user can update repository content with read-only permission (CVSS 6.5)
- [CVE-2026-22592](https://cve.now/CVE-2026-22592.md): Gogs is Vulnerable to Denial of Service (CVSS 6.5)
- [CVE-2025-64175](https://cve.now/CVE-2025-64175.md): Gogs Vulnerable to 2FA Bypass via Recovery Code (CVSS 7.7)
- [CVE-2025-64111](https://cve.now/CVE-2025-64111.md): Gogs's update .git/config file allows remote command execution (CVSS 9.3)
- [CVE-2025-8110](https://cve.now/CVE-2025-8110.md): File overwrite in file update API in Gogs (CVSS 8.7, KEV)
- [CVE-2025-47943](https://cve.now/CVE-2025-47943.md): Gogs stored XSS in PDF renderer (CVSS 6.3)
- [CVE-2024-56731](https://cve.now/CVE-2024-56731.md): Gogs deletion of internal files allows remote command execution (CVSS 10.0)
- [CVE-2024-55947](https://cve.now/CVE-2024-55947.md): Gogs has a Path Traversal in file update API (CVSS 8.7)
- [CVE-2024-54148](https://cve.now/CVE-2024-54148.md): Gogs has a Path Traversal in file editing UI (CVSS 8.7)
- [CVE-2022-1884](https://cve.now/CVE-2022-1884.md): Remote Command Execution in gogs/gogs (CVSS 10.0)
- [CVE-2022-2024](https://cve.now/CVE-2022-2024.md): OS Command Injection in gogs/gogs (CVSS 9.8)
- [CVE-2022-32174](https://cve.now/CVE-2022-32174.md): Gogs - XSS (CVSS 9.0)
- [CVE-2022-1986](https://cve.now/CVE-2022-1986.md): OS Command Injection in gogs/gogs (CVSS 10.0)
- [CVE-2022-31038](https://cve.now/CVE-2022-31038.md): XSS vulnerability in repository issue list in Gogs (CVSS 5.4)
- [CVE-2022-1993](https://cve.now/CVE-2022-1993.md): Path Traversal in gogs/gogs (CVSS 8.1)
- [CVE-2022-1992](https://cve.now/CVE-2022-1992.md): Path Traversal in gogs/gogs (CVSS 10.0)
- [CVE-2022-1285](https://cve.now/CVE-2022-1285.md): Server-Side Request Forgery (SSRF) in gogs/gogs (CVSS 8.3)
- [CVE-2022-1464](https://cve.now/CVE-2022-1464.md): Stored xss bug in gogs/gogs (CVSS 7.3)
- [CVE-2022-0415](https://cve.now/CVE-2022-0415.md): Remote Command Execution in uploading repository file in gogs/gogs (CVSS 9.9)
- [CVE-2022-0870](https://cve.now/CVE-2022-0870.md): Server-Side Request Forgery (SSRF) in gogs/gogs (CVSS 5.0)
- [CVE-2022-0871](https://cve.now/CVE-2022-0871.md): Missing Authorization in gogs/gogs (CVSS 8.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/gogs
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.