CVE-2014-8682: SQL Injection in Gogs
Summary
CVE-2014-8682: SQL Injection in Gogs. Affects gogs.io/gogs versions >= 0.3.1, < 0.5.8. Fixed in 0.5.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs (aka Go Git Service) is an open-source self-hosted Git service written in Go. It provides a lightweight and efficient way to manage repositories, users, and organizations. Gogs is vulnerable to multiple SQL injection vulnerabilities in versions 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta. These vulnerabilities allow remote attackers to execute arbitrary SQL commands by exploiting the 'q' parameter in the 'api/v1/repos/search' and 'api/v1/users/search' endpoints.
Vulnerability Detail
The SQL injection vulnerabilities in Gogs can be exploited by remote attackers to execute arbitrary SQL commands. The 'q' parameter in the 'api/v1/repos/search' and 'api/v1/users/search' endpoints is not properly handled, leading to the execution of unauthorized SQL queries. This can result in unauthorized access to sensitive information, modification of data, or even the complete compromise of the affected system. The Common Vulnerabilities and Exposures (CVE) identifier for this vulnerability is CVE-2014-8682. The vulnerability has a CVSS v3 score of 7.3, indicating a high severity level.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.8
This is the first release that contains the fix.
go get gogs.io/gogs@v0.5.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can sanitize and validate user input before passing it to the 'q' parameter in the affected endpoints. This can be done by implementing proper input validation and parameter binding techniques. Here is an example of how to sanitize user input in Go:
def sanitizeInput(input string) string {
// Implement input sanitization logic here
return sanitizedInput
}
// Example usage
q := sanitizeInput(userInput)
// Use the sanitized input in the 'q' parameter
Conclusion
In conclusion, Gogs versions 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta are vulnerable to SQL injection. This can be exploited by remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized access or data compromise. To mitigate this vulnerability, it is crucial to upgrade to Gogs version 0.5.8 or later. Additionally, implementing proper input validation and sanitization techniques can serve as a temporary workaround. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gogs.io/gogs →
FAQ
Gogs (Go Git Service) is an open-source self-hosted Git service written in Go. It provides a lightweight and efficient way to manage repositories, users, and organizations.
Versions 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta of Gogs are affected by this SQL injection vulnerability.
This vulnerability allows remote attackers to execute arbitrary SQL commands, potentially leading to unauthorized access to sensitive information, data modification, or complete system compromise.
To fix this vulnerability, it is recommended to upgrade to Gogs version 0.5.8 or later, which includes a patch for the SQL injection vulnerability.
As a temporary workaround, users can sanitize and validate user input before passing it to the affected endpoints. Implementing proper input validation and parameter binding techniques can help mitigate the risk of SQL injection attacks.
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
