{"version":"https://jsonfeed.org/version/1.1","title":"Patchfirst: gogs vulnerabilities","home_page_url":"https://patchfirst.co/vendor/gogs/","feed_url":"https://patchfirst.co/feed/vendor/gogs.json","description":"New and newly exploited gogs CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.","language":"en-GB","items":[{"id":"CVE-2026-52813","url":"https://patchfirst.co/cve/CVE-2026-52813/","title":"CVE-2026-52813: Gogs: Path Traversal in organization name results in RCE through Git hooks","content_text":"gogs · gogs. Not in CISA KEV. EPSS 1.1% (higher than 65.8% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Named in 5 threat reports. Priority 77.5 of 100.","summary":"Gogs: Path Traversal in organization name results in RCE through Git hooks","date_published":"2026-06-24T00:00:00.000Z","date_modified":"2026-06-26T03:55:38.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":77.5,"kev":null,"epss":{"score":0.01107,"percentile":0.65811},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1"},"vendor":"gogs","product":"gogs","techniqueIds":[],"reportCount":5,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2026-52806","url":"https://patchfirst.co/cve/CVE-2026-52806/","title":"CVE-2026-52806: Gogs: RCE via git rebase --exec argument injection in pull request merge","content_text":"gogs · gogs. Not in CISA KEV. EPSS 7.9% (higher than 94.7% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 73.0 of 100.","summary":"Gogs: RCE via git rebase --exec argument injection in pull request merge","date_published":"2026-06-24T00:00:00.000Z","date_modified":"2026-06-26T03:55:44.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":73,"kev":null,"epss":{"score":0.07934,"percentile":0.94725},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1"},"vendor":"gogs","product":"gogs","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2025-8110#kev","url":"https://patchfirst.co/cve/CVE-2025-8110/","title":"[KEV] CVE-2025-8110: Gogs Path Traversal Vulnerability","content_text":"Gogs · Gogs. In CISA KEV since 2026-01-12. ENISA EUVD lists it as exploited. EPSS 85.2% (higher than 99.71% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 74.1 of 100.","summary":"Gogs Path Traversal Vulnerability","date_published":"2026-01-12T00:00:00.000Z","date_modified":"2026-10-14T21:10:00.000Z","tags":["kev","public-exploit","T1190","T1059"],"_patchfirst":{"reason":"kev","priority":74.1,"kev":{"dateAdded":"2026-01-12","ransomware":false},"epss":{"score":0.85202,"percentile":0.99714},"cvss":{"score":8.8,"severity":"HIGH","version":"3.1"},"vendor":"Gogs","product":"Gogs","techniqueIds":["T1190","T1059"],"reportCount":0,"hasPublicExploit":true,"euvdExploited":true}},{"id":"CVE-2024-55947","url":"https://patchfirst.co/cve/CVE-2024-55947/","title":"CVE-2024-55947: Gogs has a Path Traversal in file update API","content_text":"gogs · gogs. Not in CISA KEV. EPSS 77.8% (higher than 99.57% of CVEs). CVSS 8.7 HIGH. Public exploit code exists. Priority 32.4 of 100.","summary":"Gogs has a Path Traversal in file update API","date_published":"2024-12-23T00:00:00.000Z","date_modified":"2024-12-24T15:59:02.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":32.4,"kev":null,"epss":{"score":0.77836,"percentile":0.9957},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0"},"vendor":"gogs","product":"gogs","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}},{"id":"CVE-2022-2024","url":"https://patchfirst.co/cve/CVE-2022-2024/","title":"CVE-2022-2024: OS Command Injection in gogs/gogs","content_text":"gogs · gogs/gogs. Not in CISA KEV. EPSS 97.8% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Priority 26.8 of 100.","summary":"OS Command Injection in gogs/gogs","date_published":"2023-02-25T00:00:00.000Z","date_modified":"2025-03-11T15:39:29.000Z","tags":[],"_patchfirst":{"reason":"published","priority":26.8,"kev":null,"epss":{"score":0.97839,"percentile":0.99907},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.0"},"vendor":"gogs","product":"gogs/gogs","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-32174","url":"https://patchfirst.co/cve/CVE-2022-32174/","title":"CVE-2022-32174: Gogs - XSS","content_text":"gogs · gogs. Not in CISA KEV. EPSS 58.2% (higher than 99.09% of CVEs). CVSS 9.0 CRITICAL. Priority 27.5 of 100.","summary":"Gogs - XSS","date_published":"2022-10-11T00:00:00.000Z","date_modified":"2025-05-16T13:49:17.000Z","tags":[],"_patchfirst":{"reason":"published","priority":27.5,"kev":null,"epss":{"score":0.58246,"percentile":0.99093},"cvss":{"score":9,"severity":"CRITICAL","version":"3.1"},"vendor":"gogs","product":"gogs","techniqueIds":[],"reportCount":0,"hasPublicExploit":false,"euvdExploited":false}},{"id":"CVE-2022-0415","url":"https://patchfirst.co/cve/CVE-2022-0415/","title":"CVE-2022-0415: Remote Command Execution in uploading repository file in gogs/gogs","content_text":"gogs · gogs/gogs. Not in CISA KEV. EPSS 65.9% (higher than 99.27% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 31.8 of 100.","summary":"Remote Command Execution in uploading repository file in gogs/gogs","date_published":"2022-03-21T00:00:00.000Z","date_modified":"2024-08-02T23:25:40.000Z","tags":["public-exploit"],"_patchfirst":{"reason":"published","priority":31.8,"kev":null,"epss":{"score":0.65935,"percentile":0.99271},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.0"},"vendor":"gogs","product":"gogs/gogs","techniqueIds":[],"reportCount":0,"hasPublicExploit":true,"euvdExploited":false}}]}