VulertSecurity VulertSecurity

Vulnerability Database · Go · gogs.io/gogs · Version

gogs.io/gogs v0.13.1

v0.13.1 is affected by 136 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to.

Critical 16 High 29 Medium 24 Low 2 Unrated 65

All gogs.io/gogs versions & vulnerabilities → Source repository Search the database for this package →
Released 22 Dec 2024 Licence MIT Also known from other sources 93 Newer releases 300 Database updated 23/Oct/2026

Release and licence data published by the Go module proxy. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

gogs.io/gogs v0.13.1 vulnerabilities

136 vulnerabilities cover gogs.io/gogs v0.13.1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2026-52813: Gogs Path Traversal Vulnerability Leading to Remote Code Execution 10.0 critical 0.14.3 23 Jun 2026
CVE-2024-56731: Gogs Critical Vulnerability Allows Remote Command Execution via .git Directory Manipulation 10.0 critical 0.13.3 24 Jun 2025
CVE-2022-1884: OS Command Injection in gogs 10.0 critical 0.12.8 02 Jun 2022
CVE-2026-52806: Gogs Remote Code Execution via Git Rebase Argument Injection 9.9 critical 0.14.3 23 Jun 2026
CVE-2024-39930: Gogs SSH Server Argument Injection Vulnerability 9.9 critical 0.13.1 23 Dec 2024
CVE-2024-39932: Gogs Arbitrary File Write Vulnerability 9.9 critical 0.13.1 23 Dec 2024
CVE-2024-39931: Gogs Arbitrary Command Execution Vulnerability 9.9 critical 0.13.1 23 Dec 2024
CVE-2024-54148: Remote Command Execution Vulnerability in Gogs 9.8 high 0.13.1 23 Dec 2024
CVE-2022-20240: Phone Services AppOps Restriction Bypass 9.8 critical 0.12.11 28 Feb 2023
CVE-2022-2024: Gogs OS Command Injection vulnerability 9.8 critical 0.12.11 28 Feb 2023
CVE-2022-1986: OS Command Injection in Gogs file editor 9.8 critical 0.12.9 08 Jun 2022
CVE-2019-14544: Insecure Permissions in Gogs 9.8 critical 0.11.91 18 May 2021
CVE-2026-25921: Gogs Cross-Repository LFS Object Overwrite Vulnerability 9.3 critical 0.14.2 05 Mar 2026
CVE-2025-64111: Gogs Remote Command Execution via .git/config Update 9.3 critical 0.13.4 06 Feb 2026
CVE-2022-1992: Path Traversal in Gogs File Editor on Windows 9.1 critical 0.12.9 08 Jun 2022
CVE-2026-52811: Gogs Arbitrary File Write via Parent Symlink 9.0 critical 0.14.3 23 Jun 2026
CVE-2026-52798: Gogs Stored XSS Vulnerability in .ipynb Preview 8.9 high 0.14.3 22 Jun 2026
CVE-2026-52800: Gogs Vulnerable to CSRF Leading to Organization Owner Takeover 8.8 high 0.14.3 23 Jun 2026
CVE-2026-26194: Gogs Release Tag Option Injection Vulnerability 8.8 high 0.14.2 05 Mar 2026
Path Traversal in file update API in gogs 8.8 high 0.13.1 23 Dec 2024
CVE-2024-44625: Remote Code Execution Vulnerability in Gogs up to Version 0.13.0 8.8 high No fix published 15 Nov 2024
CVE-2022-0415: Unrestricted Upload of File with Dangerous Type in Gogs 8.8 high 0.12.6 28 Mar 2022
CVE-2026-52805: Gogs Repository Migration Redirect Bypass Leading to Internal Repository Theft 8.7 high 0.14.3 23 Jun 2026
CVE-2026-26022: Gogs Stored XSS Vulnerability via Data URI in Issue Comments 8.7 high 0.14.2 05 Mar 2026
CVE-2025-8110: Gogs Local Code Execution Vulnerability Due to Symbolic Link Bypass 8.7 high No fix published 10 Dec 2025
Critical XSS Vulnerability in Gogs due to Outdated Notebookjs 8.5 high 0.14.3 19 Jun 2026
CVE-2026-52797: Gogs Path Traversal Vulnerability Leading to Denial of Service 8.5 high 0.14.0 16 Jun 2026
CVE-2022-1285: Server-Side Request Forgery in gogs webhook 8.3 high 0.12.8 03 Jun 2022
CVE-2022-0871: Gogs Improper PAM Authorization Handling 8.2 high 0.12.5 14 Mar 2022
Improper Authorization in Gogs 8.2 high 0.12.5 12 Mar 2022
CVE-2026-52801: Gogs Local Repository Import Vulnerability via Mirror Settings 8.1 high 0.14.3 23 Jun 2026
CVE-2022-1993: Path Traversal in Git HTTP endpoints in Gogs 8.1 high 0.12.9 08 Jun 2022
CVE-2026-25119: Gogs Authentication Bypass via Unvalidated Reverse Proxy Headers 7.7 high 0.14.3 22 Jun 2026
CVE-2024-39933: Gogs Argument Injection Vulnerability Leading to File Disclosure 7.7 high 0.13.1 23 Dec 2024
CVE-2026-52799: Gogs Attachment Download Vulnerability Allows Unauthorized Access to Private Files 7.5 high 0.14.3 22 Jun 2026
CVE-2018-20303: Gogs Directory Traversal Vulnerability 7.5 high 0.11.82.1218 14 May 2022
CVE-2026-26276: Gogs DOM-Based XSS via Milestone Selection 7.3 high No fix published 05 Mar 2026
Stored XSS Vulnerability in Gogs Due to Vulnerable Mermaid Diagram Renderer 7.3 high 0.13.4 06 Feb 2026
CVE-2026-24135: Gogs Arbitrary File Deletion via Path Traversal in Wiki Page Update 7.2 high 0.13.4 06 Feb 2026
CVE-2026-52812: Gogs LFS Dedupe Path Vulnerability Leading to Cross-Tenant Data Leakage 7.1 high 0.14.3 23 Jun 2026
CVE-2026-52810: Gogs Repository Access Control Bypass Vulnerability 7.1 high 0.14.3 23 Jun 2026
CVE-2026-52808: Gogs API Vulnerability Allows Write-Level Collaborators to Modify Admin-Only Settings 7.1 high 0.14.3 23 Jun 2026
CVE-2026-25232: Gogs Protected Branch Deletion Bypass Vulnerability 7.1 high 0.14.1 17 Feb 2026
CVE-2026-26196: Gogs API Token Exposure via URL Parameters 6.9 medium No fix published 05 Mar 2026
CVE-2026-26195: Gogs Stored XSS Vulnerability in Branch and Wiki Views 6.9 medium No fix published 05 Mar 2026
CVE-2026-25242: Gogs Unauthenticated File Upload Vulnerability 6.9 medium 0.14.1 17 Feb 2026
CVE-2026-52809: Gogs Password-Reset Token Vulnerability Leading to Account Takeover 6.8 medium 0.14.3 23 Jun 2026
CVE-2026-23633: Gogs Arbitrary File Read/Write via Path Traversal in Git Hook Editing 6.5 medium 0.13.4 06 Feb 2026
CVE-2026-23632: Gogs Repository Content Modification with Read-Only Permissions 6.5 medium 0.13.4 06 Feb 2026
CVE-2026-22592: Gogs Denial of Service Vulnerability Due to Repository Deletion 6.5 medium 0.13.4 06 Feb 2026
CVE-2018-17031: Gogs XSS Vulnerability 6.1 medium 0.12.0 14 May 2022
CVE-2018-15178: Open Redirect in gogs.io/gogs 6.1 medium 0.12.0 29 Jun 2021
CVE-2025-65852: Gogs Repository Deletion API Authorization Bypass Vulnerability 5.7 medium 0.13.4 06 Feb 2026
CVE-2026-52815: Gogs Unauthenticated Organization Teams Information Disclosure Vulnerability 5.5 medium 0.14.3 23 Jun 2026
CVE-2026-52814: Gogs Unauthenticated Asymmetric Denial of Service via SSH Handshake Stall 5.5 medium 0.14.3 23 Jun 2026
CVE-2026-52804: Gogs Privilege Escalation via Collaboration Access Mode Validation 5.5 medium 0.14.3 23 Jun 2026
CVE-2026-52816: Gogs Unauthenticated Jupyter Notebook Sanitizer Allows Arbitrary Data URIs Leading to XSS 5.4 medium 0.14.3 23 Jun 2026
CVE-2026-52802: Open Redirect Vulnerability in Gogs Allows Arbitrary External Redirection 5.4 medium 0.14.3 23 Jun 2026
CVE-2022-31038: Cross-site Scripting vulnerability in Gogs 5.4 medium 0.12.9 08 Jun 2022
CVE-2022-1464: Cross-site Scripting in Gogs 5.4 medium 0.12.7 24 May 2022
CVE-2026-25229: Gogs Authorization Bypass Allows Cross-Repository Label Modification 5.3 medium 0.14.0 17 Feb 2026
CVE-2020-14958: Insecure Permissions in Gogs 5.3 medium 0.12.0 18 May 2021
CVE-2026-25120: Gogs Cross-Repository Comment Deletion Vulnerability 5.1 medium 0.14.0 17 Feb 2026
SSRF in repository migration in gogs.io/gogs 5.0 medium 0.12.5 14 Mar 2022
CVE-2022-0870: SSRF in repository migration in gogs.io/gogs 5.0 medium 0.12.5 12 Mar 2022
CVE-2025-64719: Gogs Denial of Service Vulnerability in Repository/Wiki File Listing 4.9 medium 0.14.3 22 Jun 2026
CVE-2026-52796: Gogs DoS Vulnerability in Issue Index Pattern Rendering 3.5 low 0.14.3 22 Jun 2026
CVE-2026-52814: Gogs Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall N/A unrated No fix published 25 Jun 2026
CVE-2026-52802: Open Redirect Vulnerability in Gogs Package N/A unrated No fix published 25 Jun 2026
CVE-2026-52807: Gogs DOM-based XSS Vulnerability in New Issue Page N/A unrated No fix published 25 Jun 2026
CVE-2026-25119: Gogs Authentication Bypass via Unvalidated Reverse Proxy Headers N/A unrated No fix published 25 Jun 2026
CVE-2026-52810: Gogs Repository Write Access Vulnerability N/A unrated No fix published 25 Jun 2026
CVE-2026-52801: Gogs Local Repository Import Vulnerability N/A unrated No fix published 25 Jun 2026
CVE-2026-52799: Gogs Missing Authorization in Attachment Download Vulnerability N/A unrated No fix published 25 Jun 2026
CVE-2026-52797: Gogs Denial of Service Vulnerability Due to Critical File Overwriting N/A unrated No fix published 25 Jun 2026
CVE-2026-52800: Gogs Vulnerable to CSRF Leading to Organization Owner Takeover N/A unrated No fix published 25 Jun 2026
CVE-2026-52806: Gogs RCE via git rebase --exec Argument Injection in Pull Request Merge N/A unrated No fix published 25 Jun 2026
CVE-2026-52808: Gogs API Vulnerability Allows Write-Level Collaborators to Modify Admin-Only Settings N/A unrated No fix published 25 Jun 2026
CVE-2026-52798: Gogs Stored XSS Vulnerability in .ipynb Preview N/A unrated No fix published 25 Jun 2026
CVE-2026-52813: Gogs Path Traversal Vulnerability Leading to RCE N/A unrated No fix published 25 Jun 2026
CVE-2026-47267: SSRF Vulnerability in gogs.io/gogs Webhook Deliveries N/A unrated No fix published 25 Jun 2026
CVE-2026-52805: Gogs Migration Redirect Bypass Leading to Internal Repository Theft N/A unrated No fix published 25 Jun 2026
CVE-2026-52812: Gogs LFS Dedupe Path Vulnerability Leaks Private Repo Content N/A unrated No fix published 25 Jun 2026
Critical XSS Vulnerability in Gogs Package: Outdated notebookjs in .ipynb Files Renderer N/A unrated No fix published 25 Jun 2026
CVE-2026-52815: Gogs Unauthenticated Organization Teams Information Disclosure Vulnerability N/A unrated No fix published 25 Jun 2026
CVE-2026-52811: Gogs Repository File Upload Vulnerability Leading to Unauthorized File Writes N/A unrated No fix published 25 Jun 2026
CVE-2025-64719: Gogs Denial of Service Vulnerability in Repository/Wiki File Listing N/A unrated No fix published 25 Jun 2026
CVE-2026-52816: Gogs Unauthenticated Jupyter Notebook Sanitizer Leads to XSS Vulnerability N/A unrated No fix published 25 Jun 2026
CVE-2026-52804: Gogs Privilege Escalation Vulnerability via Collaboration Access Mode Validation N/A unrated No fix published 25 Jun 2026
CVE-2026-52796: Gogs DoS Vulnerability in Issue Index Pattern Rendering N/A unrated No fix published 25 Jun 2026
CVE-2026-52809: Gogs Password-Reset Token Vulnerability Ignoring Configuration Settings N/A unrated No fix published 25 Jun 2026
CVE-2026-52807: Gogs DOM-based XSS Vulnerability via Milestone Name on New Issue Page N/A high 0.14.3 23 Jun 2026
CVE-2026-47267: Gogs SSRF Vulnerability in Webhook Deliveries N/A medium 0.14.3 22 Jun 2026
CVE-2026-25921: Gogs Cross-Repository LFS Object Overwrite Vulnerability N/A unrated No fix published 10 Mar 2026
CVE-2026-26194: Gogs Release Tag Option Injection Vulnerability N/A unrated No fix published 10 Mar 2026
CVE-2026-26195: Gogs Stored XSS Vulnerability in Branch and Wiki Views N/A unrated No fix published 10 Mar 2026
CVE-2026-26196: Gogs Access Token Exposure via URL Parameters in API Requests N/A unrated No fix published 10 Mar 2026
CVE-2026-26022: Gogs Stored XSS Vulnerability in Issue Comments N/A unrated No fix published 10 Mar 2026
CVE-2026-26276: Gogs Package Vulnerability - DOM-based XSS via Milestone Selection N/A unrated No fix published 10 Mar 2026
CVE-2026-25232: Gogs Protected Branch Deletion Bypass Vulnerability N/A unrated No fix published 23 Feb 2026
CVE-2026-25229: Gogs Authorization Bypass Allows Cross-Repository Label Modification N/A unrated No fix published 23 Feb 2026
CVE-2026-25242: Unauthenticated File Upload Vulnerability in Gogs N/A unrated No fix published 23 Feb 2026
CVE-2026-25120: Gogs Cross-Repository Comment Deletion Vulnerability N/A unrated No fix published 23 Feb 2026
CVE-2025-64111: Remote Command Execution Vulnerability in Gogs N/A unrated No fix published 17 Feb 2026
CVE-2026-23632: Gogs Repository Update Vulnerability with Read-Only Permissions N/A unrated No fix published 17 Feb 2026
CVE-2026-22592: Gogs Denial of Service Vulnerability N/A unrated No fix published 17 Feb 2026
CVE-2026-24135: Gogs Arbitrary File Deletion via Path Traversal in Wiki Page Update N/A unrated No fix published 17 Feb 2026
CVE-2026-23633: Gogs Arbitrary File Read/Write Vulnerability via Path Traversal N/A unrated No fix published 17 Feb 2026
Stored XSS Vulnerability in Gogs Package - gogs.io/gogs N/A unrated No fix published 17 Feb 2026
CVE-2025-65852: Gogs Repository Deletion API Authorization Bypass Vulnerability N/A unrated No fix published 17 Feb 2026
CVE-2025-8110: Gogs Package Vulnerable to Bypass of CVE-2024-55947 N/A unrated No fix published 15 Dec 2025
CVE-2024-56731: Remote Command Execution Vulnerability in Gogs Package N/A unrated 0.13.3 28 Jul 2025
CVE-2025-47943: Gogs XSS Vulnerability in PDF Renderer N/A unrated 0.13.3-0.20250608224432-110117b2e5e5 28 Jul 2025
CVE-2024-54148: Remote Command Execution Vulnerability in gogs.io/gogs N/A unrated 0.13.1 07 Jan 2025
CVE-2024-55947: Path Traversal Vulnerability in gogs.io/gogs File Update API N/A unrated 0.13.1 07 Jan 2025
CVE-2024-44625: Remote Code Execution Vulnerability in Gogs N/A unrated No fix published 19 Nov 2024
CVE-2018-15178: Open Redirect in gogs.io/gogs N/A unrated 0.12.0 21 Aug 2024
CVE-2020-14958: Insecure Permissions in Gogs in gogs.io/gogs N/A unrated 0.12.0 21 Aug 2024
CVE-2019-14544: Insecure Permissions in Gogs in gogs.io/gogs N/A unrated 0.11.91 21 Aug 2024
OS Command Injection in gogs.io/gogs N/A unrated 0.12.8 21 Aug 2024
Server-Side Request Forgery in gogs webhook in gogs.io/gogs N/A unrated 0.12.8 21 Aug 2024
Cross-site Scripting in Gogs in gogs.io/gogs N/A unrated 0.12.7 21 Aug 2024
CVE-2022-1986: OS Command Injection in Gogs N/A unrated 0.12.9 21 Aug 2024
CVE-2022-0415: Unrestricted Upload of File with Dangerous Type in Gogs N/A unrated 0.12.6 21 Aug 2024
CVE-2022-1993: Path Traversal in Git HTTP endpoints in Gogs N/A unrated 0.12.9 21 Aug 2024
CVE-2022-1992: Path Traversal in file editor on Windows in Gogs N/A unrated 0.12.9 21 Aug 2024
CVE-2022-0870: SSRF in repository migration in gogs.io/gogs N/A unrated 0.12.5 21 Aug 2024
OS Command Injection in gogs.io/gogs N/A unrated 0.12.8 21 Aug 2024
Cross-Site Scripting via Cookies in gogs.io/gogs N/A unrated 0.12.8 21 Aug 2024
CVE-2022-31038: Cross-site Scripting vulnerability in repository issue list in Gogs N/A unrated 0.12.9 21 Aug 2024
CVE-2022-0871: Gogs.io/gogs - Improper PAM Authorization Handling N/A unrated 0.12.5 21 Aug 2024
SSRF in repository migration in gogs.io/gogs N/A unrated 0.12.5 21 Aug 2024
CVE-2018-17031: XSS Vulnerability in gogs.io/gogs N/A unrated 0.12.0 20 Aug 2024
CVE-2022-2024: Gogs OS Command Injection in gogs.io/gogs N/A unrated 0.12.11 20 Aug 2024
CVE-2021-32546: OS Command Injection in gogs N/A critical 0.12.8 02 Jun 2022
Cross-Site Scripting via Cookies in Gogs N/A low 0.12.8 02 Jun 2022

Looking for another version, or everything Vulert holds for gogs.io/gogs?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About gogs.io/gogs v0.13.1

Is gogs.io/gogs v0.13.1 vulnerable?

Yes. 136 vulnerabilities in the Vulert database cover gogs.io/gogs v0.13.1: 16 critical, 29 high, 24 medium and 2 low, plus 65 not yet rated. Each entry above names the fixed version to move to.

Is v0.13.1 the latest release of gogs.io/gogs?

No. v0.13.1 was published 22 Dec 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor gogs.io/gogs for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the gogs.io/gogs version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.