| CVE-2026-52796 | BAJO3.5 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, specially crafted issue index pattern can cause a panic when rendering, resulting in denial of service. In internal/markup/markup.go, RenderIssueIndexPattern renders the issue index pattern to a link using com.Expand, which is not safe: when the configure | 24/06/2026 |
| CVE-2026-47267 | ALTO8.3 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, the fix for CVE-2022-1285 prevents adding webooks or running webhooks with URLs with a hostname that resolves in localCIDRs. However, webhooks still follow redirects allowing to access hostname inside localCIDRs. This vulnerability is fixed in 0.14.3. | 24/06/2026 |
| CVE-2026-25119 | ALTO7.7 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker | 24/06/2026 |
| CVE-2025-64719 | MEDIO4.9 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, a malicious user with rights to create a new file on a repository or wiki page can trigger a denial of service condition in which the pages containing the listing of files will return HTTP error 500 and render the web interface unusable for the repository | 24/06/2026 |
| GHSA-6vxv-wg6j-5qwp | ALTO | Gogs: XSS in .ipynb files renderer due to outdated notebookjs | 19/06/2026 |
| CVE-2026-26276 | MEDIO5.4 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, an attacker can store an HTML/JavaScript payload in a repository’s Milestone name, and when another user selects that Milestone on the New Issue page (/issues/new), a DOM-Based XSS is triggered. This issue has been patched in version 0.14.2. | 05/03/2026 |
| CVE-2026-26196 | MEDIO5.3 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, gogs api still accepts tokens in url params like token and access_token, which can leak through logs, browser history, and referrers. This issue has been patched in version 0.14.2. | 05/03/2026 |
| CVE-2026-26195 | MEDIO6.1 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, stored xss is still possible through unsafe template rendering that mixes user input with safe plus permissive sanitizer handling of data urls. This issue has been patched in version 0.14.2. | 05/03/2026 |
| CVE-2026-26194 | ALTO7.3 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.1 | 05/03/2026 |
| CVE-2026-26022 | MEDIO5.4 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, a stored cross-site scripting (XSS) vulnerability exists in the comment and issue description functionality. The application's HTML sanitizer explicitly allows data: URI schemes, enabling authenticated users to inject arbitrary JavaScript executio | 05/03/2026 |
| CVE-2026-25921 | CRÍTICO9.3 | Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in version 0.14.2. | 05/03/2026 |
| CVE-2026-25242 | CRÍTICO9.8 | Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /releases/attachments and /issues/attachments. This enables the | 19/02/2026 |
| CVE-2026-25232 | ALTO8.8 | Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing the branch protection m | 19/02/2026 |
| CVE-2026-25229 | MEDIO6.5 | Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verif | 19/02/2026 |
| CVE-2026-25120 | BAJO2.7 | Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authoriza | 19/02/2026 |
| GO-2026-4454 | — | Gogs vulnerable to Stored XSS via Mermaid diagrams in gogs.io/gogs | 17/02/2026 |
| CVE-2025-65852 | — | Gogs has authorization bypass in repository deletion API in gogs.io/gogs | 17/02/2026 |
| GHSA-26gq-grmh-6xm6 | ALTO7.3 | Gogs vulnerable to Stored XSS via Mermaid diagrams | 06/02/2026 |
| CVE-2026-24135 | ALTO8.1 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulating the old_title paramet | 06/02/2026 |
| CVE-2026-23633 | MEDIO6.5 | Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This issue has been patched in versions 0.13.4 and 0.14.0+dev. | 06/02/2026 |