CVE-2022-0870
Server-Side Request Forgery (SSRF) in gogs/gogs
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Server-Side Request Forgery (SSRF) in gogs/gogs
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.
- Record
CVE-2022-0870- CVSS 3.0
- 5.0 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
EUVDEUVD-2022-1366
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.
- Record
EUVD-2022-1366- CVSS 3.0
- 5.0 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7v5r-r995-q2x2
SSRF in repository migration
Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Gogs should be ran in its own private network until users can update.
- Record
GHSA-7v5r-r995-q2x2- CVSS 3.0
- 5.0 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
NVD
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.
- Record
CVE-2022-0870- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 3.0
- 5.0 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-0870
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.
- Record
ALPINE-CVE-2022-0870- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
OSV
Server-Side Request Forgery (SSRF) in gogs/gogs
Server-Side Request Forgery (SSRF) in GitHub repository gogs/gogs prior to 0.12.5.
- Record
CVE-2022-0870- CVSS 3.0
- 5.0 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGHSA-7v5r-r995-q2x2
SSRF in repository migration
Gogs is a self-hosted Git service. The malicious user is able to discover services in the internal network through repository migration functionality. All installations accepting public traffic are affected. Internal network CIDRs are prohibited to be used as repository migration targets. Users should upgrade to 0.12.5 or the latest 0.13.0+dev. Gogs should be ran in its own private network until users can update.
- Record
GHSA-7v5r-r995-q2x2- CVSS 3.0
- 5.0 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N - Weakness
- CWE-918
- Updated
- 2026-11-02
OSVGO-2022-0566 No score
SSRF in repository migration in gogs.io/gogs
SSRF in repository migration in gogs.io/gogs
- Record
GO-2022-0566- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gogs.io/gogsGo |
before 0.12.5 | 0.12.5 |
gogsAlpine:v3.15 |
before 0.12.6-r0 | 0.12.6-r0 |
gogsAlpine:v3.16 |
before 0.12.6-r0 | 0.12.6-r0 |
gogsAlpine:v3.17 |
before 0.12.6-r0 | 0.12.6-r0 |
gogsAlpine:v3.18 |
before 0.12.6-r0 | 0.12.6-r0 |
gogsAlpine:v3.19 |
before 0.12.6-r0 | 0.12.6-r0 |
gogsAlpine:v3.20 |
before 0.12.6-r0 | 0.12.6-r0 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Gogs <0.12.5 - Server-Side Request Forgery |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, references | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-0870 is a medium vulnerability (CVSS 5.0) in Gogs, published March 11, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.42%, the 88th percentile. Fixed in gogs.io/gogs 0.12.5.
References
huntr.dev/bounties/327797d7-ae41-498f-9bff-cc0bf98cf531
github.com/gogs/gogs/commit/91f2cde5e95f146bfe4765e837e7282df6c7cabb
nvd.nist.gov/vuln/detail/CVE-2022-0870
security.alpinelinux.org/vuln/CVE-2022-0870