PatchTheCVE: gogs

CVE-2026-26276: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 10:26:01 +0000

HIGH 7.3: Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is triggered. This issue has been patched in v

CVE-2026-26196: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 10:25:55 +0000

MEDIUM 5.3: Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_token, which can leak through logs, browser history, and referrers. This issue has been patched in version 0.14.2.

CVE-2026-26195: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 10:25:55 +0000

MEDIUM 6.1: Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2.

CVE-2026-26194: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 10:25:55 +0000

HIGH 7.3: Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been pa

CVE-2026-26022: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 10:25:36 +0000

HIGH 8.7: Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrary

CVE-2026-25921: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 10:25:25 +0000

CRITICAL 9.3: Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2.

CVE-2026-24135: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 10:22:41 +0000

HIGH 8.1: Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulating t

CVE-2026-23633: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 10:21:52 +0000

MEDIUM 6.5: Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

CVE-2026-23632: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 10:21:52 +0000

MEDIUM 6.5: Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint "PUT /repos/:owner/:repo/contents/*" does not require write permissions and allows access with read permission only via repoAssignment(). After passing the permission check, PutContents() invokes UpdateRepoFile

CVE-2026-22592: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 10:20:07 +0000

MEDIUM 6.5: Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, an authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

CVE-2025-64175: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 09:53:57 +0000

HIGH 8.8: Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-account bypass. If an attacker knows a victim’s username and password, they can use any unused recovery code (e.g., from their own account) to

CVE-2025-64111: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 09:53:50 +0000

CRITICAL 9.8: Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command execution. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

CVE-2025-8110: Gogs Path Traversal Vulnerability

Wed, 14 Oct 2026 21:10:00 +0000

HIGH 8.8: Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.

CVE-2024-56731: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 08:12:51 +0000

CRITICAL 10.0: Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance w

CVE-2024-55947: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 08:11:28 +0000

HIGH 8.8: Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

CVE-2024-54148: Gogs is an open source self-hosted Git service

Wed, 17 Jun 2026 08:09:51 +0000

CRITICAL 9.8: Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

CVE-2024-44625: Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor

Wed, 17 Jun 2026 07:52:56 +0000

HIGH 8.8: Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

CVE-2022-1884: A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows serv

Wed, 17 Jun 2026 04:23:16 +0000

CRITICAL 9.8: A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allo

CVE-2024-39933: Gogs through 0.13.0 allows argument injection during the tagging of a new release.

Wed, 17 Jun 2026 07:43:03 +0000

HIGH 7.7: Gogs through 0.13.0 allows argument injection during the tagging of a new release.

CVE-2024-39932: Gogs through 0.13.0 allows argument injection during the previewing of changes.

Wed, 17 Jun 2026 07:43:03 +0000

CRITICAL 9.9: Gogs through 0.13.0 allows argument injection during the previewing of changes.

CVE-2024-39931: Gogs through 0.13.0 allows deletion of internal files.

Wed, 17 Jun 2026 07:43:03 +0000

CRITICAL 9.9: Gogs through 0.13.0 allows deletion of internal files.

CVE-2024-39930: The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to re

Wed, 17 Jun 2026 07:43:03 +0000

CRITICAL 9.9: The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows