GO
Product
gogs
On CISA KEVExploited in the wild
74
CVEs
1
On KEV
10.0
Max CVSS
1
New 30D
Severity mix
Critical 19High 27Medium 26Low 2
Watch
Add gogs to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-8110 In wildKEV | 8.8 | Dec 10 | File overwrite in file update API in Gogs Affected: through 0.13.3 |
| CVE-2026-52798 | 8.9 | Jun 24 | Gogs: Stored XSS in `.ipynb` Preview Affected: < 0.14.3 |
| CVE-2026-52800 | 8.8 | Jun 24 | Gogs: CSRF Leading to Organization Owner Takeover Affected: < 0.14.3 |
| CVE-2026-25232 | 8.8 | Feb 19 | Gogs has a Protected Branch Deletion Bypass in Web Interface Affected: < 0.14.1 |
| CVE-2025-64175 | 8.8 | Feb 6 | Gogs Vulnerable to 2FA Bypass via Recovery Code Affected: < 0.14.0+dev; < 0.13.4 |
| CVE-2024-55947 | 8.8 | Dec 23 | Gogs has a Path Traversal in file update API Affected: < 0.13.1 |
| CVE-2024-44625 | 8.8 | Nov 15 | Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go Affected: through 0.13.0 |
| CVE-2021-32546 | 8.8 | Jun 2 | Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely Affected: before 0.12.8 |
| CVE-2022-0415 | 8.8 | Mar 21 | Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6 Affected: before 0.12.6 |
| CVE-2018-15193 | 8.8 | Aug 8 | A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link Affected: 0.11.53 |
| CVE-2026-52805 | 8.7 | Jun 24 | Gogs: Migration Redirect Bypass Leads to Internal Repository Theft Affected: < 0.14.3 |
| CVE-2018-16409 | 8.6 | Sep 3 | In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF Affected: 0.11.53 |
| CVE-2018-15192 | 8.6 | Aug 8 | An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services Affected: through 0.11.53 |
| CVE-2026-52797 | 8.5 | Jun 24 | Gogs: Overwriting critical files results in a denial of service Affected: < 0.14.0 |
| CVE-2026-47267 | 8.3 | Jun 24 | Gogs: SSRF in webhook deliveries Affected: < 0.14.3 |
| CVE-2026-52801 | 8.1 | Jun 24 | Gogs: Ability to import local repositories via Mirror Settings Affected: < 0.14.3 |
| CVE-2026-24135 | 8.1 | Feb 6 | Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update Affected: < 0.14.0+dev; < 0.13.4 |
| CVE-2022-1993 | 8.1 | Jun 9 | Path Traversal in GitHub repository gogs/gogs prior to 0.12.9 Affected: before 0.12.9 |
| CVE-2026-25119 | 7.7 | Jun 24 | Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers Affected: < 0.14.3 |
| CVE-2024-39933 | 7.7 | Jul 4 | Gogs through 0.13.0 allows argument injection during the tagging of a new release Affected: through 0.13.0 |
| CVE-2026-52799 | 7.5 | Jun 24 | Gogs: Missing Authorization in Attachment Download Affected: < 0.14.3 |
| CVE-2018-20303 | 7.5 | Dec 20 | In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a… Affected: before 0.11.82.1218 |
| CVE-2026-26194 | 7.3 | Mar 5 | Gogs: Release tag option injection in release deletion Affected: < 0.14.2 |
| CVE-2020-15867 | 7.2 | Oct 16 | The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution Affected: 0.5.5 through 0.12.2 |
| CVE-2026-52812 | 7.1 | Jun 24 | Gogs: LFS dedupe path leaks private repo content across tenants Affected: < 0.14.3 |
| CVE-2026-52810 | 7.1 | Jun 24 | Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion Affected: < 0.14.3 |
| CVE-2026-52808 | 7.1 | Jun 24 | Gogs: Write-level collaborators can mutate admin-only repository settings via API Affected: < 0.14.3 |
Showing 27