CVE-2022-32174criticalCWE-79

CVE-2022-32174: critical vulnerability in gogs

Gogs - XSS

Published · Updated

Follow this CVE+ Monitor gogs+ Monitor gogs.io/gogs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

40Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9epss 58%
In short

Gogs versions 0.6.5 to 0.12.10 allow attackers to inject malicious scripts that are permanently stored on the site. When other users view the affected page, the scripts execute in their browsers, potentially allowing attackers to steal their accounts.

Technical detail

Stored XSS vulnerability in Gogs allowing persistent injection of malicious JavaScript across multiple user sessions. The vulnerability enables account takeover by capturing session tokens or credentials when victims access contaminated content. Affects versions v0.6.5 through v0.12.10.

Summary generated and translated by AI from the official description.
In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Affected products
gogs · gogs
Related CVEs — gogs

In the same product, most dangerous first.

CVE-2024-55947HIGHGogs has a Path Traversal in file update APIEPSS 77.7%CVE-2026-52806CRITICALGogs: RCE via git rebase --exec argument injection in pull request mergeEPSS 7.9%CVE-2026-52815MEDIUMGogs: Unauthenticated Organization Teams Information Disclosure via APIEPSS 1.5%CVE-2025-64111CRITICALGogs's update .git/config file allows remote command executionEPSS 1.4%CVE-2024-56731CRITICALGogs deletion of internal files allows remote command executionEPSS 1.1%CVE-2026-52813CRITICALGogs: Path Traversal in organization name results in RCE through Git hooksEPSS 1.1%