Cross-site Scripting in Gogs

中 5.4CVE-2022-1464 · GHSA-ff28-f46g-r9g8 · GO-2022-0597 · 05/05/2022 公開 · 17/06/2026 更新

要点

CVE-2022-1464 は gogs.io/gogs, gogs (gogs) に影響する深刻度「中」 (CVSS 5.4) の脆弱性です。
今後30日間に悪用される確率（EPSS）：0.72%（全脆弱性の 53.9% より高い）。
対処：0.12.7 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
gogs.io/gogs Go	`< 0.12.7`	`0.12.7`
gogs gogs	`< 0.12.7`	`0.12.7`

概要

Impact

The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations allow uploading SVG (text/xml) files as issue attachments (non-default) are affected.

Patches

Correctly setting the Content Security Policy for the serving endpoint. Users should upgrade to 0.12.7 or the latest 0.13.0+dev.

Workarounds

Disable uploading SVG files (text/xml) as issue attachments.

References

https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/

For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6919.

NVD の説明

Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .