https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T08:00:53.438827+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-221909 EUVD-2026-221909 2026-10-13T08:00:53.441857+00:00 EUVD-2026-221909 https://cve.radiocsirt.org/vuln/fkie_cve-2022-2024 fkie_cve-2022-2024 2026-10-13T08:00:53.441885+00:00

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

 https://cve.radiocsirt.org/vuln/ghsa-pfvh-p8qp-9ww9 GHSA-pfvh-p8qp-9ww9 — Gogs OS Command Injection vulnerability 2026-10-13T08:00:53.441912+00:00

Affected: Go: gogs.io/gogs

### Impact

The malicious user is able to update a crafted `config` file into repository's `.git` directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) on case-insensitive file systems (Windows, macOS, etc.) are affected.

### Patches

Make sanitization of upload path to `.git` directory to be case-insensitive. Users should upgrade to 0.12.11 or the latest 0.13.0+dev.

### Workarounds

Disable [repository upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129).

### References

https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97/

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7030.

 https://cve.radiocsirt.org/vuln/gsd-2022-2024 gsd-2022-2024 2026-10-13T08:00:53.441947+00:00 gsd-2022-2024