Исправлено в
CVE, затрагивающие 0.11
| CVE | Название | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|
| CVE-2025-8110 | File overwrite in file update API in Gogs | 8.7 | KEV | 80.3% | 2025-12-10 |
| CVE-2024-39930 | The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to re... | 9.9 | — | 2024-07-04 | |
| CVE-2024-39931 | Gogs through 0.13.0 allows deletion of internal files. | 9.9 | — | 2024-07-04 | |
| CVE-2024-39932 | Gogs through 0.13.0 allows argument injection during the previewing of changes. | 9.9 | — | 2024-07-04 | |
| CVE-2022-1884 | Remote Command Execution in gogs/gogs | 9.8 | — | 2024-11-15 | |
| CVE-2018-18925 | Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated b... | 9.8 | — | 2018-11-04 | |
| CVE-2024-56731 | Gogs deletion of internal files allows remote command execution | 9.8 | — | 2025-06-24 | |
| CVE-2019-14544 | routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks... | 9.8 | — | 2019-08-02 | |
| CVE-2022-1986 | OS Command Injection in gogs/gogs | 9.8 | — | 2022-06-09 | |
| CVE-2022-2024 | OS Command Injection in gogs/gogs | 9.8 | — | 2023-02-25 | |
| CVE-2026-25921 | Gogs: Cross-repository LFS object overwrite via missing content hash verification | 9.3 | — | 2026-03-05 | |
| CVE-2025-64111 | Gogs's update .git/config file allows remote command execution | 9.3 | — | 2026-02-06 | |
| CVE-2022-1992 | Path Traversal in gogs/gogs | 9.1 | — | 2022-06-09 | |
| CVE-2022-0871 | Missing Authorization in gogs/gogs | 9.1 | — | 2022-03-11 | |
| CVE-2022-32174 | Gogs - XSS | 9.0 | — | 2022-10-11 | |
| CVE-2026-26194 | Gogs: Release tag option injection in release deletion | 8.8 | — | 2026-03-05 | |
| CVE-2024-44625 | Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor... | 8.8 | — | 2024-11-15 | |
| CVE-2022-0415 | Remote Command Execution in uploading repository file in gogs/gogs | 8.8 | — | 2022-03-21 | |
| CVE-2021-32546 | Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute cod... | 8.8 | — | 2022-06-02 | |
| CVE-2018-15193 | A CSRF vulnerability in the admin panel in Gogs through 0.11.53 allows remote attackers to execute admin opera... | 8.8 | — | 2018-08-08 | |
| CVE-2024-55947 | Gogs has a Path Traversal in file update API | 8.7 | — | 2024-12-23 | |
| CVE-2024-54148 | Gogs has a Path Traversal in file editing UI | 8.7 | — | 2024-12-23 | |
| CVE-2018-15192 | An SSRF vulnerability in webhooks in Gitea through 1.5.0-rc2 and Gogs through 0.11.53 allows remote attackers... | 8.6 | — | 2018-08-08 | |
| CVE-2018-16409 | In Gogs 0.11.53, an attacker can use migrate to send arbitrary HTTP GET requests, leading to SSRF. | 8.6 | — | 2018-09-03 | |
| CVE-2022-1993 | Path Traversal in gogs/gogs | 8.1 | — | 2022-06-09 | |
| CVE-2025-64175 | Gogs Vulnerable to 2FA Bypass via Recovery Code | 7.7 | — | 2026-02-06 | |
| CVE-2024-39933 | Gogs through 0.13.0 allows argument injection during the tagging of a new release. | 7.7 | — | 2024-07-04 | |
| CVE-2018-20303 | In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can al... | 7.5 | — | 2018-12-20 | |
| CVE-2026-24135 | Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update | 7.2 | — | 2026-02-06 | |
| CVE-2020-15867 | The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be... | 7.2 | — | 2020-10-16 | |
| CVE-2026-25232 | Gogs has a Protected Branch Deletion Bypass in Web Interface | 7.1 | — | 2026-02-19 | |
| CVE-2026-26196 | Gogs: Access tokens get exposed through URL params in API requests | 6.9 | — | 2026-03-05 | |
| CVE-2026-26195 | Gogs: Stored XSS in branch and wiki views through author and committer names | 6.9 | — | 2026-03-05 | |
| CVE-2026-25242 | Gogs allows unauthenticated file uploads | 6.9 | — | 2026-02-19 | |
| CVE-2026-23632 | Gogs user can update repository content with read-only permission | 6.5 | — | 2026-02-06 | |
| CVE-2026-22592 | Gogs is Vulnerable to Denial of Service | 6.5 | — | 2026-02-06 | |
| CVE-2020-14958 | In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check. | 6.5 | — | 2020-06-21 | |
| CVE-2022-1285 | Server-Side Request Forgery (SSRF) in gogs/gogs | 6.5 | — | 2022-06-01 | |
| CVE-2026-23633 | Gogs has arbitrary file read/write via path traversal in Git hook editing | 6.5 | — | 2026-02-06 | |
| CVE-2018-17031 | In Gogs 0.11.53, an attacker can use a crafted .eml file to trigger MIME type sniffing, which leads to XSS, as... | 6.1 | — | 2018-09-14 | |
| CVE-2018-15178 | Open redirect vulnerability in Gogs before 0.12 allows remote attackers to redirect users to arbitrary website... | 6.1 | — | 2018-08-08 | |
| CVE-2020-9329 | Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/d... | 5.9 | — | 2020-02-21 | |
| CVE-2026-26276 | Gogs: DOM-based XSS via milestone selection | 5.4 | — | 2026-03-05 | |
| CVE-2022-31038 | XSS vulnerability in repository issue list in Gogs | 5.4 | — | 2022-06-09 | |
| CVE-2022-1464 | Stored xss bug in gogs/gogs | 5.4 | — | 2022-05-05 | |
| CVE-2026-26022 | Gogs: Stored XSS via data URI in issue comments | 5.4 | — | 2026-03-05 | |
| CVE-2022-0870 | Server-Side Request Forgery (SSRF) in gogs/gogs | 5.3 | — | 2022-03-11 | |
| CVE-2026-25229 | Gogs Authorization Bypass Allows Cross-Repository Label Modification | 5.3 | — | 2026-02-19 | |
| CVE-2026-25120 | Gogs Allows Cross-Repository Comment Deletion via DeleteComment | 5.1 | — | 2026-02-19 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).