CVE-2022-1464

Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account...

CVE-2022-1986

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9...

CVE-2022-1285

Server-Side Request Forgery SSRF in GitHub repository gogs/gogs prior to 0.12.8...

CVE-2022-1993

Path Traversal in GitHub repository gogs/gogs prior to 0.12.9...

CVE-2022-2024

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11...

CVE-2022-0415

Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6...

CVE-2024-39930

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated...

The vulnerability of the editFilePost() function in the Gog tool for creating self-governed Git repositories allows a hacker to execute arbitrary code.

The vulnerability of the editFilePost function in the Gogs self-managed Git repository creation tool is related to improper restrictions on the path name of the restricted directory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

SUSE CVE-2024-54148

Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1...

SUSE CVE-2024-55947

Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1...

The vulnerability of the Gogs software interface allows a hacker to gain access to read, modify, or delete data.

The vulnerability of the Gogs Git repository creation software interface is related to errors in handling symbolic links. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to read, modify, or delete data...

The vulnerability of the interface of the Gogs self-managed Git repository creation software allows a hacker to write arbitrary files.

The vulnerability of the Gogs self-managed Git repository creation software interface is related to improper restrictions on the path name to the restricted-access directory. Exploiting this vulnerability allows a malicious actor, operating remotely, to write arbitrary files...

GO-2024-3355 Remote Command Execution in file editing in gogs in gogs.io/gogs

Remote Command Execution in file editing in gogs in gogs.io/gogs...

GO-2024-3356 Path Traversal in file update API in gogs in gogs.io/gogs

Path Traversal in file update API in gogs in gogs.io/gogs...

Remote Command Execution

Gogs is vulnerable to Remote Command Execution. The vulnerability is due to improper validation of symlink files, allowing a malicious user to commit and edit crafted symlink files in a repository to gain SSH access to the server...

Gogs has an argument Injection in the built-in SSH server

Impact When the built-in SSH server is enabled server STARTSSHSERVER = true, unprivileged user accounts with at least one SSH key can execute arbitrary commands on the Gogs instance with the privileges of the user specified by RUNUSER in the configuration. It allows attackers to access and alter...

GHSA-VM62-9JW3-C8W3 Gogs has an argument Injection in the built-in SSH server

Impact When the built-in SSH server is enabled server STARTSSHSERVER = true, unprivileged user accounts with at least one SSH key can execute arbitrary commands on the Gogs instance with the privileges of the user specified by RUNUSER in the configuration. It allows attackers to access and alter...

Gogs allows argument injection during the previewing of changes

Impact Unprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user's code hosted on the same instance. Patches Unintended Git...

GHSA-CCQV-43VM-4F3W Gogs allows deletion of internal files

Impact Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUNUSER in the configuration. It allows attackers to access and alter any users' code hosted on the same instance. Patches Deletion of .git files has been prohibit...

Gogs allows deletion of internal files

Impact Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUNUSER in the configuration. It allows attackers to access and alter any users' code hosted on the same instance. Patches Deletion of .git files has been prohibit...