1324 matches found
PT-2026-6745
Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.4 Description An OS command injection exists due to an insufficient patch for a previous issue. An attacker can abuse a symlink and the repository contents API to update files within the .git directory, specifically...
Gogs 路径遍历漏洞
Gogs Go Git Service is a self-service Git hosting service developed by the Gogs team using the Go language. It supports creating and migrating public/private repositories, as well as adding and removing repository collaborators. Gogs versions prior to 0.13.3 have a path traversal vulnerability;...
CVE-2026-24135: Improper Limitation of a Pathname to a Restricted Directory
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulatin...
CVE-2026-23633: Improper Limitation of a Pathname to a Restricted Directory
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This issue has been patched in versions 0.13.4 and 0.14.0+dev...
PT-2026-6758
Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.4 Gogs versions 0.13.0 through 0.13.3 Description Gogs is a self-hosted Git service. A path traversal issue exists in the updateWikiPage function. An authenticated user with write access to a repository's wiki can...
CVE-2025-64111: Improper Neutralization of Special Elements used in an OS Command
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command execution. This issue has been patched in versions 0.13.4 and 0.14.0+dev...
CVE-2026-23632: Missing Authorization
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint "PUT /repos/:owner/:repo/contents/" does not require write permissions and allows access with read permission only via repoAssignment. After passing the permission check, PutContents invokes UpdateRepoFile,...
Gogs 路径遍历漏洞
Gogs Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team. It supports creating and migrating public/private repositories, as well as adding and removing repository collaborators. Gogs versions prior to 0.13.3 have a path traversal vulnerability; this...
Gogs 安全漏洞
Gogs Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team. It supports creating and migrating public/private repositories, as well as adding and removing repository collaborators. Gogs versions 0.13.3 and earlier have security vulnerabilities. These...
PT-2026-20974
Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.4 Description A critical authorization bypass exists in the Gogs repository deletion API. The DELETE /api/v1/repos/:owner/:repo endpoint lacks necessary permission validation, allowing any authenticated user with re...
PT-2026-6859
Summary Due to the insufficient patch for the https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7, it's still possible to update files in the .git directory and achieve remote command execution. Details Function UpdateRepoFile security check under some if conditions. While...
Gogs 安全漏洞
Gogs Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team. It supports creating and migrating public/private repositories, as well as adding and removing repository collaborators. Gogs versions 0.13.3 and earlier have a security vulnerability. This vulnerabilit...
PT-2026-6755
Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.4 Gogs versions prior to 0.14.0+dev Description Gogs is a self-hosted Git service susceptible to a denial-of-service DOS attack. An authenticated user can trigger a crash by initiating a mirror synchronization on a...
PT-2026-6751
Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.4 Gogs versions 0.14.0+dev and earlier Description Gogs, an open-source self-hosted Git service, has an issue where the 2FA recovery code validation does not limit codes by user. This allows for cross-account bypass...
CVE-2025-64175: Improper Authentication
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use any unused recovery code e.g., from their own account to...
Gogs 操作系统命令注入漏洞
Gogs Go Git Service is a Go-based self-service Git hosting service developed by the Gogs team. It supports creating and migrating public/private repositories, as well as adding and removing repository collaborators. Gogs versions 0.13.3 and earlier had an operating system command injection...
Gogs <= 0.13.3 Multiple Vulnerabilities
According to its self-reported version, the instance of Gogs running on the remote host is prior or equal to 0.13.3. It is, therefore, affected by multiple vulnerabilities, including: - Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. CVE-2025-8110 -...
CISA Warns of Active Exploitation of Gogs Vulnerability Enabling Code Execution
The U.S. Cybersecurity and Infrastructure Security Agency CISA has warned of active exploitation of a high-severity security flaw impacting Gogs by adding it to its Known Exploited Vulnerabilities KEV catalog. The vulnerability, tracked as CVE-2025-8110 CVSS score: 8.7, relates to a case of path...
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities KEV Catalog, based on evidence of active exploitation. CVE-2025-8110link is external Gogs Path Traversal Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significan...
