CVE-2014-8681: SQL Injection in gogs.io/gogs
Summary
CVE-2014-8681: SQL Injection in gogs.io/gogs. Affects gogs.io/gogs versions >= 0.3.1, < 0.5.8. Fixed in 0.5.8. How to fix ↓
Also tracked for
The same CVE-2014-8681 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs (aka Go Git Service) is an open-source self-hosted Git service written in Go. It provides a lightweight and efficient way to manage Git repositories. Gogs allows users to create, manage, and collaborate on Git repositories, providing features such as issue tracking, pull requests, and code reviews. However, versions 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta of Gogs are vulnerable to a SQL injection attack.
Vulnerability Detail
The vulnerability, identified as CVE-2014-8681, exists in the GetIssues function in models/issue.go in Gogs. It allows remote attackers to execute arbitrary SQL commands by exploiting the label parameter in the user/repos/issues endpoint. This vulnerability can be leveraged to manipulate the database and potentially gain unauthorized access to sensitive information. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.5.8
This is the first release that contains the fix.
go get gogs.io/gogs@v0.5.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable or restrict access to the user/repos/issues endpoint. This can be achieved by modifying the application's routing configuration or implementing access control rules to block or limit requests to the vulnerable endpoint.
Conclusion
In conclusion, the SQL injection vulnerability in Gogs versions 0.3.1-9 through 0.5.6.x before 0.5.6.1025 Beta poses a moderate risk to the security of the application. It is crucial for Gogs users to upgrade to the patched version or implement the recommended workaround to protect their data and prevent unauthorized access. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for gogs.io/gogs →
FAQ
Gogs is an open-source self-hosted Git service written in Go. It provides a lightweight and efficient way to manage Git repositories.
SQL injection is a code injection technique that attackers use to exploit vulnerabilities in a web application's database layer. By inserting malicious SQL statements, an attacker can manipulate the database and potentially gain unauthorized access to sensitive information.
This vulnerability allows remote attackers to execute arbitrary SQL commands, which can lead to unauthorized access to the application's database and potentially sensitive information. It is important for Gogs users to upgrade to the patched version or apply the recommended workaround to mitigate the risk.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5. While it is not the highest severity level, it still poses a significant risk to the security of the application and its data.
You can use Vulert's playground at Vulert Scanner to check if your Gogs installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using Gopkg.lock to assess the vulnerability status without requiring access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
