{"id":"CVE-2018-20303","aliases":["EUVD-2022-3398","GHSA-9hxg-w7qf-hh93"],"status":"published","title":"Gogs Directory Traversal","description":"In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.03291,"percentile":0.8857,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2018-12-20T00:00:00Z","modified":"2026-10-20T10:48:03Z","fixes":[{"ecosystem":"Go","package":"gogs.io/gogs","fixed_in":["0.11.80-0.20181218063808-ff93d9dbda5c"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"gogs.io/gogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.80-0.20181218063808-ff93d9dbda5c"}]}]},{"source":"osv","ecosystem":"Go","package":"gogs.io/gogs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.11.80-0.20181218063808-ff93d9dbda5c"}]}]}],"products":[{"vendor":"gogs","product":"gogs"}],"references":[{"url":"https://github.com/gogs/gogs/commit/ff93d9dbda5cebe90d86e4b7dfb2c6b8642970ce","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://pentesterlab.com/exercises/cve-2018-18925/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/gogs/gogs/issues/5558","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-20303","tags":["advisory"]},{"url":"https://pentesterlab.com/exercises/cve-2018-18925","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9hxg-w7qf-hh93"},{"url":"https://github.com/gogs/gogs","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2018-20303","description":"In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.","status":"published","published":"2018-12-20T00:00:00Z","modified":"2024-08-05T11:58:18.905Z","updated_at":"2026-11-02T14:35:00.237825Z"}],"euvd":[{"id":"EUVD-2022-3398","description":"In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.","status":"published","published":"2018-12-20T00:00:00Z","modified":"2024-08-05T11:58:18Z","updated_at":"2026-11-03T02:39:30.889297Z"}],"ghsa":[{"id":"GHSA-9hxg-w7qf-hh93","title":"Gogs Directory Traversal","description":"In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.","status":"published","published":"2022-05-14T01:37:52Z","modified":"2026-05-14T22:33:40Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:40:10.269075Z"}],"nvd":[{"id":"CVE-2018-20303","description":"In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.","status":"published","published":"2018-12-20T00:29:00.35Z","modified":"2026-06-17T01:52:35.247Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"CVE-2018-20303","description":"In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.","status":"published","published":"2018-12-20T00:29:00.35Z","modified":"2026-10-20T10:48:03.637672161Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:09.145458Z"},{"id":"GHSA-9hxg-w7qf-hh93","title":"Gogs Directory Traversal","description":"In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.","status":"published","published":"2022-05-14T01:37:52Z","modified":"2026-05-14T22:46:29.11001Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:43.875515Z"}]}}