Most recent entries from all

CLEANSTART-2024-YF95833 — Stored xss bug in GitHub repository gogs/gogs prior to 0

2026-10-13T03:42:32.897813+00:00

Affected: CleanStart: gogs

Security vulnerability affects the gogs package. Stored xss bug in GitHub repository gogs/gogs prior to 0.

EUVD-2026-11695

2026-10-13T03:42:32.897914+00:00

EUVD-2026-11695

fkie_cve-2022-1464

2026-10-13T03:42:32.897944+00:00

Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .

GHSA-ff28-f46g-r9g8 — Cross-site Scripting in Gogs

2026-10-13T03:42:32.898013+00:00

Affected: Go: gogs.io/gogs

### Impact

The malicious user is able to upload a crafted SVG file as the issue attachment to archive XSS. All installations [allow uploading SVG (`text/xml`) files as issue attachments (non-default)](https://github.com/gogs/gogs/blob/e51e01683408e10b3dcd2ace65e259ca7f0fd61b/conf/app.ini#L283-L284) are affected.

### Patches

Correctly setting the Content Security Policy for the serving endpoint. Users should upgrade to 0.12.7 or the latest 0.13.0+dev.

### Workarounds

[Disable uploading SVG files (`text/xml`) as issue attachments](https://github.com/gogs/gogs/blob/e51e01683408e10b3dcd2ace65e259ca7f0fd61b/conf/app.ini#L283-L284).

### References

https://huntr.dev/bounties/34a12146-3a5d-4efc-a0f8-7a3ae04b198d/

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6919.

gsd-2022-1464

2026-10-13T03:42:32.898064+00:00

gsd-2022-1464