CVE-2022-2024

OS Command Injection in gogs/gogs

9.8 CriticalFix available

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

97.8%Up 95.8 points since Feb 27, 2023

What each source reports

CVE List Score used 9.8

OS Command Injection in gogs/gogs

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

Record: CVE-2022-2024
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

EUVDEUVD-2023-0760 9.8

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

Record: EUVD-2023-0760
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pfvh-p8qp-9ww9 9.8

Gogs OS Command Injection vulnerability

Impact

The malicious user is able to update a crafted config file into repository's .git directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with repository upload enabled (default) on case-insensitive file systems (Windows, macOS, etc.) are affected.

Patches

Make sanitization of upload path to .git directory to be case-insensitive. Users should upgrade to 0.12.11 or the latest 0.13.0+dev.

Workarounds

Disable repository upload.

References

https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97/

For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7030.

Record: GHSA-pfvh-p8qp-9ww9
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

NVD 9.8

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

Record: CVE-2022-2024
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

OSV 9.8

OS Command Injection in gogs/gogs

OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.

Record: CVE-2022-2024
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

OSVGHSA-pfvh-p8qp-9ww9 9.8

Gogs OS Command Injection vulnerability

Impact

Patches

Make sanitization of upload path to .git directory to be case-insensitive. Users should upgrade to 0.12.11 or the latest 0.13.0+dev.

Workarounds

Disable repository upload.

References

https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97/

For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7030.

Record: GHSA-pfvh-p8qp-9ww9
CVSS 3.1: 9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-78
Updated: 2026-11-02

OSVGO-2023-1596 No score

Gogs OS Command Injection vulnerability in gogs.io/gogs

Gogs OS Command Injection vulnerability in gogs.io/gogs

Record: GO-2023-1596
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`gogs.io/gogs` Go	before 0.12.11	0.12.11

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2022-2024 is a critical vulnerability (CVSS 9.8) in Gogs, published February 25, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 97.8%, the 99th percentile. Fixed in gogs.io/gogs 0.12.11.