Gogs: Path Traversal in organization name results in RCE through Git hooks

Gogs: RCE via git rebase --exec argument injection in pull request merge

Gogs through 0.13.0 allows argument injection during the previewing of changes

Gogs through 0.13.0 allows deletion of internal files

The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution

Gogs allows unauthenticated file uploads

Gogs's update .git/config file allows remote command execution

Gogs is an open source self-hosted Git service

Gogs has a Path Traversal in file editing UI

A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9

routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go

Gogs: Cross-repository LFS object overwrite via missing content hash verification

Path Traversal in GitHub repository gogs/gogs prior to 0.12.9

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.