CVE-2018-20303: Gogs Directory Traversal Vulnerability
Summary
CVE-2018-20303: Gogs Directory Traversal. Affects gogs.io/gogs versions < 0.11.82.1218. Fixed in 0.11.82.1218. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is a self-hosted Git service that allows users to manage their Git repositories with ease. It is designed to be simple and efficient, providing a user-friendly interface for repository management, issue tracking, and collaboration. However, prior to version 0.11.82.1218, Gogs had a critical vulnerability that exposed its file-upload functionality to directory traversal attacks, allowing unauthorized file creation on the server.
Vulnerability Detail
In pkg/tool/path.go of Gogs versions before 0.11.82.1218, a directory traversal vulnerability exists in the file-upload functionality. This flaw allows attackers to manipulate file paths and create files in unintended directories, specifically under data/sessions on the server. This could lead to unauthorized access to sensitive data or the execution of malicious scripts, posing a significant security risk.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.11.82.1218
This is the first release that contains the fix.
go get gogs.io/gogs@v0.11.82.1218Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict file uploads by implementing strict validation on file paths and ensuring that user inputs do not allow directory traversal. This can be done by sanitizing input and checking for patterns that may indicate an attempt to traverse directories.
Conclusion
The Gogs directory traversal vulnerability (CVE-2018-20303) poses a significant risk to users of the software prior to version 0.11.82.1218. It is crucial to update to the patched version to mitigate potential security threats. Additionally, implementing strict input validation can serve as a temporary workaround while ensuring ongoing monitoring for vulnerabilities.
See every vulnerability recorded for gogs.io/gogs →
FAQ
The vulnerability allows for directory traversal in the file-upload functionality, enabling unauthorized file creation on the server.
An attacker could exploit this vulnerability to create files in sensitive directories, potentially leading to data breaches or the execution of malicious code.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just the Gopkg.lock file.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
