Затронутые ветки версий
Известные уязвимости
| CVE | Название | Затронутые версии | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
| CVE-2025-8110 | File overwrite in file update API in Gogs | ≤ 0.13.3 | 8.7 | KEV | 80.3% | 2025-12-10 |
| CVE-2026-123012 | In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only... | = 0.14.3 | 7.1 | — | 2026-11-05 | |
| CVE-2026-82402 | Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite` | * | 5.3 | — | 2026-10-15 | |
| CVE-2026-52797 | Gogs: Overwriting critical files results in a denial of service | * | 8.5 | — | 2026-06-25 | |
| CVE-2026-52813 | Gogs: Path Traversal in organization name results in RCE through Git hooks | * | 10.0 | — | 2026-06-25 | |
| CVE-2026-52812 | Gogs: LFS dedupe path leaks private repo content across tenants | * | 7.1 | — | 2026-06-25 | |
| CVE-2026-52811 | Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym | * | 9.0 | — | 2026-06-25 | |
| CVE-2026-52810 | Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion | * | 7.1 | — | 2026-06-25 | |
| CVE-2026-52809 | Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES | * | 6.8 | — | 2026-06-25 | |
| CVE-2026-52808 | Gogs: Write-level collaborators can mutate admin-only repository settings via API | * | 7.1 | — | 2026-06-25 | |
| CVE-2026-52816 | Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS | * | 5.4 | — | 2026-06-25 | |
| CVE-2026-52807 | Gogs: DOM-based XSS via Milestone Name on New Issue Page | * | 4.8 | — | 2026-06-25 | |
| CVE-2026-52805 | Gogs: Migration Redirect Bypass Leads to Internal Repository Theft | * | 8.7 | — | 2026-06-25 | |
| CVE-2026-52806 | Gogs: RCE via git rebase --exec argument injection in pull request merge | * | 9.9 | — | 2026-06-25 | |
| CVE-2026-52804 | Gogs: Privilege Escalation via Collaboration Access Mode Validation | * | 5.5 | — | 2026-06-25 | |
| CVE-2026-52799 | Gogs: Missing Authorization in Attachment Download | * | 7.5 | — | 2026-06-25 | |
| CVE-2026-52801 | Gogs: Ability to import local repositories via Mirror Settings | * | 8.1 | — | 2026-06-25 | |
| CVE-2026-52800 | Gogs: CSRF Leading to Organization Owner Takeover | * | 8.8 | — | 2026-06-25 | |
| CVE-2026-52802 | Gogs: Open Redirect via redirect_to in Gogs | * | 5.4 | — | 2026-06-25 | |
| CVE-2026-52814 | Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) | * | 5.5 | — | 2026-06-25 | |
| CVE-2026-52798 | Gogs: Stored XSS in `.ipynb` Preview | * | 8.9 | — | 2026-06-25 | |
| CVE-2026-52796 | Gogs: DoS in rendering issue index pattern | * | 3.5 | — | 2026-06-25 | |
| CVE-2026-47267 | Gogs: SSRF in webhook deliveries | * | 8.3 | — | 2026-06-25 | |
| CVE-2026-25119 | Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers | * | 7.7 | — | 2026-06-25 | |
| CVE-2026-52795 | Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity | * | 4.3 | — | 2026-06-25 | |
| CVE-2025-64719 | Gogs: Denial of Service in repository/wiki file listing web pages | * | 4.9 | — | 2026-06-25 | |
| CVE-2026-52815 | Gogs: Unauthenticated Organization Teams Information Disclosure via API | * | 5.5 | — | 2026-06-25 | |
| CVE-2026-26196 | Gogs: Access tokens get exposed through URL params in API requests | * < 0.14.2 | 6.9 | — | 2026-03-05 | |
| CVE-2026-26276 | Gogs: DOM-based XSS via milestone selection | * < 0.14.2 | 5.4 | — | 2026-03-05 | |
| CVE-2026-26195 | Gogs: Stored XSS in branch and wiki views through author and committer names | * < 0.14.2 | 6.9 | — | 2026-03-05 | |
| CVE-2026-26022 | Gogs: Stored XSS via data URI in issue comments | * < 0.14.2 | 5.4 | — | 2026-03-05 | |
| CVE-2026-26194 | Gogs: Release tag option injection in release deletion | * < 0.14.2 | 8.8 | — | 2026-03-05 | |
| CVE-2026-25921 | Gogs: Cross-repository LFS object overwrite via missing content hash verification | * < 0.14.2 | 9.3 | — | 2026-03-05 | |
| CVE-2026-25229 | Gogs Authorization Bypass Allows Cross-Repository Label Modification | * < 0.14.1 | 5.3 | — | 2026-02-19 | |
| CVE-2026-25232 | Gogs has a Protected Branch Deletion Bypass in Web Interface | * < 0.14.1 | 7.1 | — | 2026-02-19 | |
| CVE-2026-25120 | Gogs Allows Cross-Repository Comment Deletion via DeleteComment | * < 0.14.0 | 5.1 | — | 2026-02-19 | |
| CVE-2026-25242 | Gogs allows unauthenticated file uploads | * < 0.14.1 | 6.9 | — | 2026-02-19 | |
| CVE-2026-24135 | Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update | * < 0.13.4 | 7.2 | — | 2026-02-06 | |
| CVE-2026-22592 | Gogs is Vulnerable to Denial of Service | * < 0.13.4 | 6.5 | — | 2026-02-06 | |
| CVE-2026-23633 | Gogs has arbitrary file read/write via path traversal in Git hook editing | * < 0.13.4 | 6.5 | — | 2026-02-06 | |
| CVE-2026-23632 | Gogs user can update repository content with read-only permission | * < 0.13.4 | 6.5 | — | 2026-02-06 | |
| CVE-2025-64175 | Gogs Vulnerable to 2FA Bypass via Recovery Code | * < 0.13.4 | 7.7 | — | 2026-02-06 | |
| CVE-2025-64111 | Gogs's update .git/config file allows remote command execution | * < 0.13.4 | 9.3 | — | 2026-02-06 | |
| CVE-2025-47943 | Gogs stored XSS in PDF renderer | * | 6.3 | — | 2025-06-24 | |
| CVE-2024-56731 | Gogs deletion of internal files allows remote command execution | * < 0.13.3 | 9.8 | — | 2025-06-24 | |
| CVE-2024-54148 | Gogs has a Path Traversal in file editing UI | * < 0.13.1 | 8.7 | — | 2024-12-23 | |
| CVE-2024-55947 | Gogs has a Path Traversal in file update API | * < 0.13.1 | 8.7 | — | 2024-12-23 | |
| CVE-2024-44625 | Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor... | ≤ 0.13.0 | 8.8 | — | 2024-11-15 | |
| CVE-2022-1884 | Remote Command Execution in gogs/gogs | ≤ 0.12.7 | 9.8 | — | 2024-11-15 | |
| CVE-2024-39931 | Gogs through 0.13.0 allows deletion of internal files. | * ≤ 0.13.0 | 9.9 | — | 2024-07-04 | |
| CVE-2024-39930 | The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to re... | * ≤ 0.13.0 | 9.9 | — | 2024-07-04 | |
| CVE-2024-39933 | Gogs through 0.13.0 allows argument injection during the tagging of a new release. | * ≤ 0.13.0 | 7.7 | — | 2024-07-04 | |
| CVE-2024-39932 | Gogs through 0.13.0 allows argument injection during the previewing of changes. | * ≤ 0.13.0 | 9.9 | — | 2024-07-04 | |
| CVE-2023-49946 | In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which... | * | — | — | 2023-12-03 | |
| CVE-2022-2024 | OS Command Injection in gogs/gogs | * < 0.12.11 | 9.8 | — | 2023-02-25 | |
| CVE-2022-32174 | Gogs - XSS | ≥ v0.6.5 < unspecified ≥ unspecified ≤ v0.12.10 ≥ 0.6.5 ≤ 0.12.10 | 9.0 | — | 2022-10-11 | |
| CVE-2022-31038 | XSS vulnerability in repository issue list in Gogs | * < 0.12.9 | 5.4 | — | 2022-06-09 | |
| CVE-2022-1992 | Path Traversal in gogs/gogs | * < 0.12.9 | 9.1 | — | 2022-06-09 | |
| CVE-2022-1993 | Path Traversal in gogs/gogs | * < 0.12.9 | 8.1 | — | 2022-06-09 | |
| CVE-2022-1986 | OS Command Injection in gogs/gogs | * < 0.12.9 | 9.8 | — | 2022-06-09 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).