gogs has 27 CVEs on record between 2022 and 2026. Disclosures have slowed: 1 in the last 90 days after 24 in the 90 before. The busiest recent month was June 2026 with 24. The median CVSS is 8.1 (high), with 4 rated critical. 4% have been exploited in the wild, in line with the corpus average. The dominant weakness classes are CWE-22 (3) and CWE-79 (3). Most affected products: gogs.io/gogs (25), gogs (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 4% vs 1% corpus
- Median CVSS
- 8.1
- Publish → KEV
- —(1)
- Last 90 days
- 1 prev 24
Worst active — by depth score
CVE-2025-8110High· 8.8Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.90CVE-2026-52806Critical· 9.9Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge68CVE-2026-52813Critical· 10.0Gogs has Path Traversal in organization name that results in RCE through Git hooks67CVE-2026-52810HighGogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion53CVE-2021-32546CriticalOS Command Injection in gogs53
gogs vulnerabilities
CVEs affecting gogs, newest first. Open any entry for full detail, references, and exploit status.
27 CVEsRSS
CVE-2026-82402Medium· 5.3PoCGogs is an open source self-hosted Git service
Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx…
CVE-2025-64719Medium· 4.9Gogs is an open source self-hosted Git service
Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files …
CVE-2026-52800High· 8.8Gogs Vulnerable to CSRF Leading to Organization Owner Takeover
Gogs Vulnerable to CSRF Leading to Organization Owner Takeover
CVE-2026-52801High· 8.1Gogs has the ability to import local repositories via Mirror Settings
Gogs has the ability to import local repositories via Mirror Settings
CVE-2026-52802Medium· 5.4Gogs has an Open Redirect via redirect_to
Gogs has an Open Redirect via redirect_to
CVE-2026-52804MediumGogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation
Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation
CVE-2026-52805High· 8.7Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft
Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft
CVE-2026-52806Critical· 9.9PoCGogs vulnerable to RCE via git rebase --exec argument injection in pull request merge
Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge
CVE-2026-52807HighGogs has DOM-based XSS via Milestone Name on New Issue Page
Gogs has DOM-based XSS via Milestone Name on New Issue Page
CVE-2026-52808High· 7.1Gogs's write-level collaborators can mutate admin-only repository settings via API
Gogs's write-level collaborators can mutate admin-only repository settings via API
CVE-2026-52809Medium· 6.8Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
Gogs's password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
CVE-2026-52810HighPoCGogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion
Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion
CVE-2026-52811CriticalGogs: UploadRepoFiles writes outside repo working tree via committed parent sym
Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym
CVE-2026-52812HighGogs: LFS dedupe path leaks private repo content across tenants
Gogs: LFS dedupe path leaks private repo content across tenants
CVE-2026-52813Critical· 10.0PoCGogs has Path Traversal in organization name that results in RCE through Git hooks
Gogs has Path Traversal in organization name that results in RCE through Git hooks
CVE-2026-52814MediumGogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)
Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)
CVE-2026-52815MediumPoCGogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API
Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API
CVE-2026-52816MediumGogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS
Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS
CVE-2026-25119HighGogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers
Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers
CVE-2026-47267MediumGogs has SSRF in webhook deliveries
Gogs has SSRF in webhook deliveries
CVE-2026-52796Low· 3.5Gogs has DoS in rendering issue index pattern
Gogs has DoS in rendering issue index pattern
CVE-2026-52798High· 8.9Gogs has Stored XSS in `.ipynb` Preview
Gogs has Stored XSS in `.ipynb` Preview
CVE-2026-52799High· 7.5Gogs Missing Authorization in Attachment Download
Gogs Missing Authorization in Attachment Download
GHSA-6vxv-wg6j-5qwpHighGogs: XSS in .ipynb files renderer due to outdated notebookjs
Gogs: XSS in .ipynb files renderer due to outdated notebookjs
CVE-2026-52797High· 8.5Gogs: Overwriting critical files results in a denial of service
Gogs: Overwriting critical files results in a denial of service
CVE-2025-8110High· 8.8CISA KEVPoCImproper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.
CVE-2021-32546CriticalOS Command Injection in gogs
OS Command Injection in gogs