CVE-2022-1986: OS Command Injection in Gogs file editor

gogs.io/gogs Updated 02 Oct 2025

Summary

08/06/2022

Disclosed on

CVE-2022-1986

CVE

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

CVE-2022-1986: OS Command Injection in file editor in Gogs. Affects gogs.io/gogs versions < 0.12.9. Fixed in 0.12.9. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Gogs is an open-source self-hosted Git service written in Go. It provides a lightweight and easy-to-use platform for managing repositories, users, and organizations. Gogs allows users to upload and manage their repositories, making it a popular choice for individuals and small teams. However, a vulnerability has been discovered in the file editor of Gogs, which can lead to OS command injection.

Vulnerability Detail

The OS command injection vulnerability in Gogs allows a malicious user to update a crafted config file into the repository's .git directory. By combining this with a crafted file deletion, the attacker can gain SSH access to the server. This vulnerability affects all installations with repository upload enabled. The impact of this vulnerability is critical, as it can lead to unauthorized access to the server and potential compromise of sensitive data.

How To Fix

Latest published version: v0.13.3 as of 22 Oct 2026

go get gogs.io/gogs@v0.13.3

Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.

If you need the minimum change

0.12.9

This is the first release that contains the fix.

go get gogs.io/gogs@v0.12.9

Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →

Workaround

There is no specific workaround mentioned for this vulnerability.

Conclusion

The OS command injection vulnerability in Gogs can lead to unauthorized access to the server and potential compromise of sensitive data. It is crucial for Gogs users to upgrade to the latest version and apply the necessary patches to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for gogs.io/gogs →

FAQ

What is Gogs?

Gogs is a self-hosted Git service written in Go. It provides a lightweight and easy-to-use platform for managing repositories, users, and organizations.

What is the impact of this vulnerability?

The impact of this vulnerability is critical. It allows an attacker to gain SSH access to the server and potentially compromise sensitive data.

How can I check if my Gogs installation is affected?

You can use Vulert's playground (https://vulert.com/scanner) to check if your Gogs installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.

Are there any known exploits for this vulnerability?

There are no known exploits for this vulnerability at the moment. However, it is recommended to upgrade to the latest version of Gogs to mitigate the risk.