CVE-2022-0415
Remote Command Execution in uploading repository file in gogs/gogs
Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Remote Command Execution in uploading repository file in gogs/gogs
Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
- Record
CVE-2022-0415- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2022-1322
Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
- Record
EUVD-2022-1322- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5gjh-5j4f-cpwv
Unrestricted Upload of File with Dangerous Type in Gogs
Impact
The malicious user is able to upload a crafted config file into repository's .git directory with to gain SSH access to the server. All installations with repository upload enabled (default) are affected.
Patches
Repository file uploads are prohibited to its .git directory. Users should upgrade to 0.12.6 or the latest 0.13.0+dev.
Workarounds
Disable repository files upload.
References
https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902/
For more information
If you have any questions or comments about this advisory, please post on #6833.
- Record
GHSA-5gjh-5j4f-cpwv- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-434
- Updated
- 2026-11-02
NVD
Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
- Record
CVE-2022-0415- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-20, CWE-434
- Updated
- 2026-11-02
OSV
Remote Command Execution in uploading repository file in gogs/gogs
Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
- Record
CVE-2022-0415- CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-5gjh-5j4f-cpwv
Unrestricted Upload of File with Dangerous Type in Gogs
Impact
The malicious user is able to upload a crafted config file into repository's .git directory with to gain SSH access to the server. All installations with repository upload enabled (default) are affected.
Patches
Repository file uploads are prohibited to its .git directory. Users should upgrade to 0.12.6 or the latest 0.13.0+dev.
Workarounds
Disable repository files upload.
References
https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902/
For more information
If you have any questions or comments about this advisory, please post on #6833.
- Record
GHSA-5gjh-5j4f-cpwv- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-20, CWE-434
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-0415
Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
- Record
UBUNTU-CVE-2022-0415- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 9.9 Critical
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGO-2022-0554 No score
Unrestricted Upload of File with Dangerous Type in Gogs in gogs.io/gogs
Unrestricted Upload of File with Dangerous Type in Gogs in gogs.io/gogs
- Record
GO-2022-0554- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gogs.io/gogsGo |
before 0.12.6 | 0.12.6 |
golang-github-gogits-go-gogs-clientUbuntu:20.04:LTS |
All versions, plus listed versions 0.0~git20160830.0.d8aff57-2 |
None known |
golang-github-gogits-go-gogs-clientUbuntu:22.04:LTS |
All versions, plus listed versions 0.0~git20160830.0.d8aff57-2 |
None known |
golang-github-gogits-go-gogs-clientUbuntu:24.04:LTS |
All versions, plus listed versions 0.0~git20160830.0.d8aff57-2 |
None known |
golang-github-gogits-go-gogs-clientUbuntu:25.10 |
All versions, plus listed versions 0.0~git20160830.0.d8aff57-2 |
None known |
golang-github-gogits-go-gogs-clientUbuntu:26.10 |
All versions, plus listed versions 0.0~git20210131.1d7215c-1 |
None known |
golang-github-gogits-go-gogs-clientUbuntu:26.04:LTS |
All versions, plus listed versions 0.0~git20160830.0.d8aff57-20.0~git20210131.1d7215c-1 |
None known |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Gogs <0.12.6 - Remote Command Execution |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0415 is a critical vulnerability (CVSS 9.9) in Gogs, published March 21, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 65.9%, the 99th percentile. Fixed in gogs.io/gogs 0.12.6.