CVE-2022-1464: Cross-site Scripting in Gogs
Summary
CVE-2022-1464: Cross-site Scripting in Gogs. Affects gogs.io/gogs versions < 0.12.7. Fixed in 0.12.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service written in Go. It provides a lightweight and easy-to-use platform for managing repositories, users, and organizations. The vulnerability in Gogs allows a malicious user to upload a crafted SVG file as an issue attachment, leading to cross-site scripting (XSS) attacks. This vulnerability affects all installations that allow uploading SVG files as issue attachments. The impact of this vulnerability can be significant as it enables an attacker to execute arbitrary code in the context of other users, potentially compromising their accounts and data.
Vulnerability Detail
The vulnerability arises from the ability to upload SVG files as issue attachments. By uploading a specially crafted SVG file, an attacker can inject malicious JavaScript code that will be executed when the file is viewed by other users. This can lead to various consequences, such as stealing sensitive information, performing actions on behalf of the victim user, or spreading malware. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.12.7
This is the first release that contains the fix.
go get gogs.io/gogs@v0.12.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the uploading of SVG files as issue attachments. This can be done by modifying the Gogs configuration file (app.ini) and removing the 'text/xml' MIME type from the allowed attachment types. Here is an example of the relevant configuration:
[attachment]
ENABLED = true
ALLOWED_TYPES = image/jpeg,image/png,application/pdf
Conclusion
The vulnerability in Gogs allows for cross-site scripting (XSS) attacks through specially crafted SVG file uploads. It is crucial for Gogs users to upgrade to the patched version (0.12.7 or 0.13.0+dev) and properly configure the Content Security Policy. Additionally, a temporary workaround is available by disabling SVG file uploads. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for gogs.io/gogs →
FAQ
The vulnerability allows an attacker to execute arbitrary code in the context of other users, potentially compromising their accounts and data.
No, only installations that allow uploading SVG files as issue attachments are affected.
The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
To fix this vulnerability, upgrade to Gogs version 0.12.7 or the latest 0.13.0+dev.
Yes, you can temporarily disable the uploading of SVG files as issue attachments by modifying the Gogs configuration file.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
