en
Gogs is an open-source project that provides a lightweight, self-hosted Git service for hosting repositories and supporting software-development collaboration. It is intended for individuals, development teams, and organizations that need to operate Git infrastructure themselves. The project is developed as a global open-source community.
As of 09/13/2026, gogs recorded 24 security vulnerabilities in the last 90 days across 1 products, including 14 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, gogs had the most security vulnerabilities in the gogs ecosystem, with 24 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
| Vulnerability | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-52797Gogs: Overwriting critical files results in a denial of service | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityHigh |
CVE-2026-52813Gogs: Path Traversal in organization name results in RCE through Git hooks | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityCritical |
CVE-2026-52812Gogs: LFS dedupe path leaks private repo content across tenants | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityHigh |
CVE-2026-52811Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published06/24/2026 | SeverityCritical |
CVE-2026-52810Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityHigh |
CVE-2026-52809Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityMedium |
CVE-2026-52808Gogs: Write-level collaborators can mutate admin-only repository settings via API | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityHigh |
CVE-2026-52816Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityMedium |
CVE-2026-52807Gogs: DOM-based XSS via Milestone Name on New Issue Page | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityMedium |
CVE-2026-52805Gogs: Migration Redirect Bypass Leads to Internal Repository Theft | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published06/24/2026 | SeverityHigh |
CVE-2026-52806Gogs: RCE via git rebase --exec argument injection in pull request merge | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityCritical |
CVE-2026-52804Gogs: Privilege Escalation via Collaboration Access Mode Validation | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published06/24/2026 | SeverityMedium |
CVE-2026-52799Gogs: Missing Authorization in Attachment Download | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityHigh |
CVE-2026-52801Gogs: Ability to import local repositories via Mirror Settings | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityHigh |
CVE-2026-52800Gogs: CSRF Leading to Organization Owner Takeover | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityHigh |
CVE-2026-52802Gogs: Open Redirect via redirect_to in Gogs | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityMedium |
CVE-2026-52814Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityMedium |
CVE-2026-52798Gogs: Stored XSS in `.ipynb` Preview | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityHigh |
CVE-2026-52796Gogs: DoS in rendering issue index pattern | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityLow |
CVE-2026-47267Gogs: SSRF in webhook deliveries | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityHigh |
CVE-2026-25119Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityHigh |
CVE-2026-52795Gogs: Authorization Bypass in Watch API allows any user to monitor private repository activity | Exploitation statusPublic exploit | FixNot confirmed | Affected productgogs | Published06/24/2026 | SeverityMedium |
CVE-2025-64719Gogs: Denial of Service in repository/wiki file listing web pages | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published06/24/2026 | SeverityMedium |
CVE-2026-52815Gogs: Unauthenticated Organization Teams Information Disclosure via API | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published06/24/2026 | SeverityMedium |
CVE-2026-26276Gogs: DOM-based XSS via milestone selection | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published03/05/2026 | SeverityHigh |
CVE-2026-26196Gogs: Access tokens get exposed through URL params in API requests | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published03/05/2026 | SeverityMedium |
CVE-2026-26195Gogs: Stored XSS in branch and wiki views through author and committer names | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published03/05/2026 | SeverityMedium |
CVE-2026-26194Gogs: Release tag option injection in release deletion | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published03/05/2026 | SeverityHigh |
CVE-2026-25921Gogs: Cross-repository LFS object overwrite via missing content hash verification | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published03/05/2026 | SeverityCritical |
CVE-2026-26022Gogs: Stored XSS via data URI in issue comments | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published03/05/2026 | SeverityHigh |
CVE-2026-25229Gogs Authorization Bypass Allows Cross-Repository Label Modification | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published02/19/2026 | SeverityMedium |
CVE-2026-25242Gogs allows unauthenticated file uploads | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published02/19/2026 | SeverityMedium |
CVE-2026-25232Gogs has a Protected Branch Deletion Bypass in Web Interface | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published02/19/2026 | SeverityHigh |
CVE-2026-25120Gogs Allows Cross-Repository Comment Deletion via DeleteComment | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published02/19/2026 | SeverityMedium |
CVE-2026-24135Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published02/06/2026 | SeverityHigh |
CVE-2026-23633Gogs has arbitrary file read/write via path traversal in Git hook editing | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published02/06/2026 | SeverityMedium |
CVE-2026-23632Gogs user can update repository content with read-only permission | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published02/06/2026 | SeverityMedium |
CVE-2026-22592Gogs is Vulnerable to Denial of Service | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published02/06/2026 | SeverityMedium |
CVE-2025-64175Gogs Vulnerable to 2FA Bypass via Recovery Code | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published02/06/2026 | SeverityHigh |
CVE-2025-64111Gogs's update .git/config file allows remote command execution | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published02/06/2026 | SeverityCritical |
CVE-2025-8110File overwrite in file update API in Gogs | Exploitation statusKEV | FixYes | Affected productgogs | Published12/10/2025 | SeverityHigh |
CVE-2025-47943Gogs stored XSS in PDF renderer | Exploitation statusPublic exploit | FixNot confirmed | Affected productgogs | Published06/24/2025 | SeverityMedium |
CVE-2024-56731Gogs deletion of internal files allows remote command execution | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published06/24/2025 | SeverityCritical |
CVE-2024-55947Gogs has a Path Traversal in file update API | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published12/23/2024 | SeverityHigh |
CVE-2024-54148Gogs has a Path Traversal in file editing UI | Exploitation statusPublic exploit | FixYes | Affected productgogs | Published12/23/2024 | SeverityHigh |
CVE-2022-1884Remote Command Execution in gogs/gogs | Exploitation statusPublic exploit | FixNot confirmed | Affected productgogs/gogs | Published11/15/2024 | SeverityCritical |
CVE-2024-44625 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published11/15/2024 | SeverityHigh |
CVE-2024-39930 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published07/04/2024 | SeverityCritical |
CVE-2024-39933 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/04/2024 | SeverityHigh |
CVE-2024-39931 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published07/04/2024 | SeverityCritical |
CVE-2024-39932 | Exploitation statusPublic exploit | FixNot confirmed | Affected productNot confirmed | Published07/04/2024 | SeverityCritical |
CVE-2022-2024OS Command Injection in gogs/gogs | Exploitation statusPublic exploit | FixYes | Affected productgogs/gogs | Published02/25/2023 | SeverityCritical |
CVE-2022-32174Gogs - XSS | Exploitation statusPublic exploit | FixNot confirmed | Affected productgogs | Published10/11/2022 | SeverityCritical |
CVE-2022-1986OS Command Injection in gogs/gogs | Exploitation statusNot confirmed | FixYes | Affected productgogs/gogs | Published06/09/2022 | SeverityCritical |
CVE-2022-31038XSS vulnerability in repository issue list in Gogs | Exploitation statusNot known exploited | FixYes | Affected productgogs | Published06/08/2022 | SeverityMedium |
CVE-2022-1993Path Traversal in gogs/gogs | Exploitation statusNot confirmed | FixYes | Affected productgogs/gogs | Published06/08/2022 | SeverityHigh |
CVE-2022-1992Path Traversal in gogs/gogs | Exploitation statusNot confirmed | FixYes | Affected productgogs/gogs | Published06/08/2022 | SeverityCritical |
CVE-2022-1285Server-Side Request Forgery (SSRF) in gogs/gogs | Exploitation statusNot confirmed | FixYes | Affected productgogs/gogs | Published06/01/2022 | SeverityHigh |
CVE-2021-32546 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published05/31/2022 | SeverityUnknown |
CVE-2022-1464Stored xss bug in gogs/gogs | Exploitation statusNot confirmed | FixYes | Affected productgogs/gogs | Published05/05/2022 | SeverityHigh |
CVE-2022-0415Remote Command Execution in uploading repository file in gogs/gogs | Exploitation statusNot confirmed | FixYes | Affected productgogs/gogs | Published03/21/2022 | SeverityCritical |
CVE-2022-0870Server-Side Request Forgery (SSRF) in gogs/gogs | Exploitation statusNot confirmed | FixYes | Affected productgogs/gogs | Published03/11/2022 | SeverityMedium |
CVE-2022-0871Missing Authorization in gogs/gogs | Exploitation statusNot confirmed | FixYes | Affected productgogs/gogs | Published03/11/2022 | SeverityHigh |
CVE-2020-15867 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published10/16/2020 | SeverityUnknown |
CVE-2020-14958 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published06/21/2020 | SeverityUnknown |
CVE-2020-9329 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published02/21/2020 | SeverityUnknown |
CVE-2019-14544 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/02/2019 | SeverityUnknown |
CVE-2018-20303 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published12/20/2018 | SeverityUnknown |
CVE-2018-18925 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/04/2018 | SeverityUnknown |
CVE-2018-17031 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/14/2018 | SeverityUnknown |
CVE-2018-16409 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/03/2018 | SeverityUnknown |
CVE-2018-15192 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/08/2018 | SeverityUnknown |
CVE-2018-15193 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/08/2018 | SeverityUnknown |
CVE-2018-15178 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/08/2018 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
