Cross-site Scripting in Gogs

TRUNG BÌNH 5.4CVE-2022-1464 · GHSA-ff28-f46g-r9g8 · GO-2022-0597 · Công bố 05/05/2022 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2022-1464 là lỗ hổng mức TRUNG BÌNH (CVSS 5.4) ảnh hưởng gogs.io/gogs, gogs (gogs).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.72%, cao hơn 53.9% các lỗ hổng khác.
Cách xử lý: cập nhật lên 0.12.7 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
gogs.io/gogs Go	`< 0.12.7`	`0.12.7`
gogs gogs	`< 0.12.7`	`0.12.7`

Mô tả

Impact

The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations allow uploading SVG (text/xml) files as issue attachments (non-default) are affected.

Patches

Correctly setting the Content Security Policy for the serving endpoint. Users should upgrade to 0.12.7 or the latest 0.13.0+dev.

Workarounds

Disable uploading SVG files (text/xml) as issue attachments.

References

https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/

For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6919.

Mô tả của NVD

Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .