Gogs vulnerabilities
59 CVEs and advisories name Gogs as an affected vendor, 1 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-25921Gogs: Cross-repository LFS object overwrite via missing content hash verification
- CVE-2026-26022Gogs: Stored XSS via data URI in issue comments
- CVE-2026-25229Gogs Authorization Bypass Allows Cross-Repository Label Modification
- CVE-2026-25242Gogs allows unauthenticated file uploads
- CVE-2026-25232Gogs has a Protected Branch Deletion Bypass in Web Interface
- CVE-2026-25120Gogs Allows Cross-Repository Comment Deletion via DeleteComment
- CVE-2026-24135Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update
- CVE-2026-23633Gogs has arbitrary file read/write via path traversal in Git hook editing
- CVE-2026-23632Gogs user can update repository content with read-only permission
- CVE-2026-22592Gogs is Vulnerable to Denial of Service
- CVE-2025-64175Gogs Vulnerable to 2FA Bypass via Recovery Code
- CVE-2025-64111Gogs's update .git/config file allows remote command execution
- CVE-2025-8110File overwrite in file update API in Gogs
- CVE-2025-47943Gogs stored XSS in PDF renderer
- CVE-2024-56731Gogs deletion of internal files allows remote command execution
- CVE-2024-55947Gogs has a Path Traversal in file update API
- CVE-2024-54148Gogs has a Path Traversal in file editing UI
- CVE-2022-1884Remote Command Execution in gogs/gogs
- CVE-2022-2024OS Command Injection in gogs/gogs
- CVE-2022-32174Gogs - XSS
- CVE-2022-1986OS Command Injection in gogs/gogs
- CVE-2022-31038XSS vulnerability in repository issue list in Gogs
- CVE-2022-1993Path Traversal in gogs/gogs
- CVE-2022-1992Path Traversal in gogs/gogs
- CVE-2022-1285Server-Side Request Forgery (SSRF) in gogs/gogs
- CVE-2022-1464Stored xss bug in gogs/gogs
- CVE-2022-0415Remote Command Execution in uploading repository file in gogs/gogs
- CVE-2022-0870Server-Side Request Forgery (SSRF) in gogs/gogs
- CVE-2022-0871Missing Authorization in gogs/gogs