Threats affecting pkg:github/gogs/gogs

5 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.7	KEVEPSS 85%	CVE-2025-8110 · Gogs Path Traversal Vulnerability High8.7KEVEPSS 85%2026-01-12CISA KEV Gogs contains a path traversal vulnerability in the PutContents API due to improper symbolic link handling. This vulnerability could allow an attacker with limited privileges to execute code remotely. The vulnerability has a high severity score of 8.7 and is known to be exploited in the wild. KEVEPSS 85%Vulnerability CWE-22 #exploited-in-the-wild	CISA KEV	2026-01-12
High	7.7	EPSS 0.7%	CVE-2024-39933gogs · Argument Injection High7.7EPSS 0.7%2024-07-04CVE Database V5CVE-2024-39933 Gogs through 0.13.0 allows argument injection during the tagging of a new release. EPSS 0.7%Vulnerability CWE-88	CVE Database V5	2024-07-04
Critical	9.9	EPSS 16%	CVE-2024-39932gogs · Code Injection Critical9.9EPSS 16%2024-07-04CVE Database V5CVE-2024-39932 Gogs through 0.13.0 allows argument injection during the previewing of changes. EPSS 16%Vulnerability CWE-94	CVE Database V5	2024-07-04
Critical	9.9	EPSS 52%	CVE-2024-39931gogs · Exposed Files or Directories Critical9.9EPSS 52%2024-07-04CVE Database V5CVE-2024-39931 Gogs through 0.13.0 allows deletion of internal files. EPSS 52%Vulnerability CWE-552	CVE Database V5	2024-07-04
Critical	9.9	EPSS 7.7%	CVE-2024-39930gogs · Argument Injection Critical9.9EPSS 7.7%2024-07-04CVE Database V5CVE-2024-39930 The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the built-in SSH server is activated. Windows installations are unaffected. EPSS 7.7%Vulnerability CWE-88	CVE Database V5	2024-07-04

Page 1 of 1