gogs vulnerabilities

CVEs per yearBy the year they were published

1. 202210
2. 20231
3. 20243
4. 20253
5. 202642

Known exploitedNewest addition to KEV first

• CVE-2025-8110

  File overwrite in file update API in Gogs

  Gogs · Gogs

  ExploitedHigh8.7

Newest CVEs

• CVE-2026-123012

  In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different…

  Gogs · Gogs

  High7.1
• CVE-2026-82402

  Gogs: Open Redirect in /redirect endpoint via backslash bypass in `IsSameSite`

  gogs · gogs

  Medium5.3
• CVE-2026-52797

  Gogs: Overwriting critical files results in a denial of service

  gogs · gogs

  High8.5
• CVE-2026-52813

  Gogs: Path Traversal in organization name results in RCE through Git hooks

  gogs · gogs

  Critical10.0
• CVE-2026-52812

  Gogs: LFS dedupe path leaks private repo content across tenants

  gogs · gogs

  High7.1
• CVE-2026-52811

  Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

  gogs · gogs

  Critical9.0
• CVE-2026-52810

  Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion

  gogs · gogs

  High7.1
• CVE-2026-52809

  Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES

  gogs · gogs

  Medium6.8
• CVE-2026-52808

  Gogs: Write-level collaborators can mutate admin-only repository settings via API

  gogs · gogs

  High7.1
• CVE-2026-52816

  Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

  gogs · gogs

  Medium5.4