CVE-2026-52816 | | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Jupyter Notebook (ipynb) sanitizer endpoint at POST /-/api/sanitize_ipynb allows arbitrary… |
CVE-2026-52815 | | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgnam… |
CVE-2026-52814 | | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs built-in Go SSH server is vulnerable to an unauthenticated, asymmetric Denial of Serv… |
CVE-2026-52813 | Critical | 10.0 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and reposit… |
CVE-2026-52812 | | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone (<LFS-root>/<oid[0]>/<oid[1]>/<oid>) but per… |
CVE-2026-52811 | | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only on the leaf of the upload target (osx.I… |
CVE-2026-52810 | | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query stri… |
CVE-2026-52809 | Medium | 6.8 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the account-activation… |
CVE-2026-52808 | High | 7.1 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, three API endpoints — PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:own… |
CVE-2026-52807 | | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go's default auto-escaping ({{.Name}}), wh… |
CVE-2026-52806 | Critical | 9.9 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creati… |
CVE-2026-52805 | High | 8.7 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a Server-Side Request Forgery (SSRF) vulnerability exists in the repository migration function… |
CVE-2026-52804 | | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collaborator can escalate their privileges to owner-level access by exploit… |
CVE-2026-52802 | Medium | 5.4 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, an open redirect vulnerability exists in Gogs where attacker-controlled redirect_to parameters… |
CVE-2026-52801 | High | 8.1 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, the Gogs Mirror Settings functionality provide an alternative way from the well protected New… |
CVE-2026-52800 | High | 8.8 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection… |
CVE-2026-52799 | High | 7.5 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, GET /attachments/:uuid returns the raw attachment file without verifying whether the requester… |
CVE-2026-52798 | High | 8.9 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, although .ipynb previews are sanitized on the server side via /-/api/sanitize_ipynb, the inser… |
CVE-2026-52797 | High | 8.5 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.0, as an authorized user, an intruder can dictate the value which is passed to the git diff comma… |
CVE-2026-52796 | Low | 3.5 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, specially crafted issue index pattern can cause a panic when rendering, resulting in denial of… |
CVE-2026-52795 | Medium | 4.3 | 2026-06-24 | Gogs is an open source self-hosted Git service. In 0.14.3 and earlier, any authenticated user can watch a private repository they have no access to, because th… |
CVE-2026-47267 | High | 8.3 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostnam… |
CVE-2026-25119 | | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authenticatio… |
CVE-2025-64719 | Medium | 4.9 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a d… |
CVE-2026-26276 | High | 7.3 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and… |
CVE-2026-26196 | Medium | 5.3 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_token, which can lea… |
CVE-2026-26195 | Medium | 6.1 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input w… |
CVE-2026-26194 | High | 7.3 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlle… |
CVE-2026-26022 | High | 8.7 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue desc… |
CVE-2026-25921 | Critical | 9.3 | 2026-03-05 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS o… |
CVE-2026-25242 | Critical | 9.8 | 2026-02-19 | Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigni… |
CVE-2026-25232 | High | 8.8 | 2026-02-19 | Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator… |
CVE-2026-25229 | Medium | 6.5 | 2026-02-19 | Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with writ… |
CVE-2026-25120 | Low | 2.7 | 2026-02-19 | Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository… |
CVE-2026-24135 | High | 8.1 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The… |
CVE-2026-23633 | Medium | 6.5 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This… |
CVE-2026-23632 | Medium | 6.5 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint "PUT /repos/:owner/:repo/contents/*" does not require write permissio… |
CVE-2026-22592 | Medium | 6.5 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, an authenticated user can cause a DOS attack. If one of the repo files is deleted… |
CVE-2025-64175 | High | 8.8 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, Gogs’ 2FA recovery code validation does not scope codes by user, enabling cross-ac… |
CVE-2025-64111 | Critical | 9.8 | 2026-02-06 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update fi… |
CVE-2025-8110 | High | 8.8 | 2025-12-10 | Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. |
CVE-2025-47943 | Medium | 6.3 | 2025-06-24 | Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present… |
CVE-2024-56731 | Critical | 10.0 | 2025-06-24 | Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote comman… |
CVE-2024-55947 | High | 8.8 | 2024-12-23 | Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. T… |
CVE-2024-54148 | Critical | 9.8 | 2024-12-23 | Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the se… |
CVE-2024-44625 | High | 8.8 | 2024-11-15 | Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go. |
CVE-2022-1884 | Critical | 9.8 | 2024-11-15 | A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper vali… |
CVE-2024-39933 | High | 7.7 | 2024-07-04 | Gogs through 0.13.0 allows argument injection during the tagging of a new release. |
CVE-2024-39932 | Critical | 9.9 | 2024-07-04 | Gogs through 0.13.0 allows argument injection during the previewing of changes. |
CVE-2024-39931 | Critical | 9.9 | 2024-07-04 | Gogs through 0.13.0 allows deletion of internal files. |
CVE-2024-39930 | Critical | 9.9 | 2024-07-04 | The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can… |
CVE-2022-2024 | Critical | 9.8 | 2023-02-25 | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11. |
CVE-2022-32174 | Critical | 9.0 | 2022-10-11 | In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover. |
CVE-2022-31038 | Medium | 5.4 | 2022-06-09 | Gogs is an open source self-hosted Git service. In versions of gogs prior to 0.12.9 `DisplayName` does not filter characters input from users, which leads to a… |
CVE-2022-1993 | High | 8.1 | 2022-06-09 | Path Traversal in GitHub repository gogs/gogs prior to 0.12.9. |
CVE-2022-1992 | Critical | 9.1 | 2022-06-09 | Path Traversal in GitHub repository gogs/gogs prior to 0.12.9. |
CVE-2022-1986 | Critical | 9.8 | 2022-06-09 | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.9. |
CVE-2021-32546 | High | 8.8 | 2022-06-02 | Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker (registered… |
CVE-2022-1285 | Medium | 6.5 | 2022-06-01 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.8. |
CVE-2022-1464 | Medium | 5.4 | 2022-05-05 | Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is ex… |
CVE-2022-0415 | High | 8.8 | 2022-03-21 | Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6. |
CVE-2022-0871 | Critical | 9.1 | 2022-03-11 | Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5. |
CVE-2022-0870 | Medium | 5.3 | 2022-03-11 | Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5. |
CVE-2020-15867 | High | 7.2 | 2020-10-16 | The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook fe… |
CVE-2020-14958 | Medium | 6.5 | 2020-06-21 | In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check. |
CVE-2020-9329 | Medium | 5.9 | 2020-02-21 | Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition. |
CVE-2019-14544 | Critical | 9.8 | 2019-08-02 | routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks. |
CVE-2018-20303 | High | 7.5 | 2018-12-20 | In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessi… |
CVE-2018-18925 | Critical | 9.8 | 2018-11-04 | Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session… |
CVE-2018-17031 | Medium | 6.1 | 2018-09-14 | In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as demonstrated by Internet Explorer, because an "X… |
CVE-2018-16409 | High | 8.6 | 2018-09-03 | In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF. |
CVE-2018-15193 | High | 8.8 | 2018-08-08 | A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin operations via a crafted issue / link. |
CVE-2018-15192 | High | 8.6 | 2018-08-08 | An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers to access intranet services. |
CVE-2018-15178 | Medium | 6.1 | 2018-08-08 | Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary websites and conduct phishing attacks via an initial /\… |