CVE-2022-0415: Unrestricted Upload of File with Dangerous Type in Gogs
Summary
CVE-2022-0415: Unrestricted Upload of File with Dangerous Type in Gogs. Affects gogs.io/gogs versions < 0.12.6. Fixed in 0.12.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service written in Go. It provides a lightweight and easy-to-use platform for managing repositories, users, and access control. Gogs allows users to upload files to repositories, which can be a potential security risk if not properly restricted.
Vulnerability Detail
The vulnerability identified as CVE-2022-0415 allows a malicious user to upload a crafted config file into a repository's .git directory, enabling them to gain SSH access to the server. This vulnerability affects all installations with repository upload enabled. By exploiting this vulnerability, an attacker can execute arbitrary commands on the server, potentially leading to unauthorized access, data breaches, or further compromise of the system.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.6
This is the first release that contains the fix.
go get gogs.io/gogs@v0.12.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable repository file uploads by modifying the Gogs configuration file (app.ini). Specifically, the REPO_UPLOAD_ENABLED setting should be set to false. This can be done by locating the following lines in the app.ini file:
[repository]
UPLOAD_ENABLED = true
And changing them to:
[repository]
UPLOAD_ENABLED = false
By disabling repository file uploads, the risk of this vulnerability can be mitigated.
Conclusion
In conclusion, the vulnerability CVE-2022-0415 in Gogs allows for the unrestricted upload of a dangerous file type, potentially leading to unauthorized access and compromise of the server. Users are advised to upgrade to the latest version of Gogs (0.12.6 or 0.13.0+dev) to fix this vulnerability. Alternatively, the temporary workaround of disabling repository file uploads can be implemented. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gogs.io/gogs →
FAQ
The impact of this vulnerability is that a malicious user can gain SSH access to the server by uploading a crafted config file into the repository's .git directory. This can lead to unauthorized access, data breaches, or further compromise of the system.
All versions of Gogs prior to 0.12.6 are affected by this vulnerability.
At the time of this advisory, there are no known public exploits for this vulnerability. However, it is important to apply the recommended fixes and security patches to prevent any potential exploitation.
Yes, the CVSS score for this vulnerability is 8.8, indicating a high severity level.
You can find more information about this vulnerability, including the advisory and related references, on the GitHub Security Advisory page: https://github.com/github/advisory-database/advisories/GHSA-5gjh-5j4f-cpwv
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
