https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 00:49:59 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-221909 EUVD-2026-221909 https://cve.radiocsirt.org/vuln/euvd-2026-221909 https://cve.radiocsirt.org/vuln/fkie_cve-2022-2024 <p>OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.</p> <p>OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-2024 https://cve.radiocsirt.org/vuln/ghsa-pfvh-p8qp-9ww9 <p><strong>Affected:</strong> Go: gogs.io/gogs</p> <p>### Impact</p> <p>The malicious user is able to update a crafted `config` file into repository&#39;s `.git` directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) on case-insensitive file systems (Windows, macOS, etc.) are affected.</p> <p>### Patches</p> <p>Make sanitization of upload path to `.git` directory to be case-insensitive. Users should upgrade to 0.12.11 or the latest 0.13.0+dev.</p> <p>### Workarounds</p> <p>Disable [repository upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129).</p> <p>### References</p> <p>https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97/</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7030.</p> <p><strong>Affected:</strong> Go: gogs.io/gogs</p> <p>### Impact</p> <p>The malicious user is able to update a crafted `config` file into repository&#39;s `.git` directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) on case-insensitive file systems (Windows, macOS, etc.) are affected.</p> <p>### Patches</p> <p>Make sanitization of upload path to `.git` directory to be case-insensitive. Users should upgrade to 0.12.11 or the latest 0.13.0+dev.</p> <p>### Workarounds</p> <p>Disable [repository upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129).</p> <p>### References</p> <p>https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97/</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7030.</p> https://cve.radiocsirt.org/vuln/ghsa-pfvh-p8qp-9ww9 https://cve.radiocsirt.org/vuln/gsd-2022-2024 gsd-2022-2024 https://cve.radiocsirt.org/vuln/gsd-2022-2024