{"id":"CVE-2020-15867","aliases":["EUVD-2020-7848"],"status":"published","description":"The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a \"Product UI does not Warn User of Unsafe Actions\" issue.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.87416,"percentile":0.99758,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"published":"2020-10-16T13:04:43Z","modified":"2026-10-24T10:31:01Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/gogs_git_hooks_rce","title":"Gogs Git Hooks Remote Code Execution","type":"exploit","platform":"Linux,Unix,Windows","date":"2020-10-07","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/gogs_git_hooks_rce"},{"source":"nuclei","id":"CVE-2020-15867","title":"Gogs 0.5.5 - 0.12.2 - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-15867.yaml"}],"products":[{"vendor":"gogs","product":"gogs"}],"references":[{"url":"https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-3-schwachstelle-in-gitea-1125-und-gogs-0122-ermoeglicht-ausfuehrung-von-code-nach-authent/","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"http://packetstormsecurity.com/files/162123/Gogs-Git-Hooks-Remote-Code-Execution.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]}],"sources":{"cve":[{"id":"CVE-2020-15867","description":"The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a \"Product UI does not Warn User of Unsafe Actions\" issue.","status":"published","published":"2020-10-16T13:04:43Z","modified":"2024-08-04T13:30:22.979Z","updated_at":"2026-11-02T14:35:50.228781Z"}],"euvd":[{"id":"EUVD-2020-7848","description":"The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a \"Product UI does not Warn User of Unsafe Actions\" issue.","status":"published","published":"2020-10-16T13:04:43Z","modified":"2024-08-04T13:30:22Z","updated_at":"2026-11-03T03:07:29.843843Z"}],"nvd":[{"id":"CVE-2020-15867","description":"The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a \"Product UI does not Warn User of Unsafe Actions\" issue.","status":"published","published":"2020-10-16T14:15:11.627Z","modified":"2026-06-17T02:57:19.363Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"updated_at":"2026-11-02T14:06:19.351389Z"}],"osv":[{"id":"CVE-2020-15867","description":"The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a \"Product UI does not Warn User of Unsafe Actions\" issue.","status":"published","published":"2020-10-16T14:15:11.627Z","modified":"2026-10-24T10:31:01.607098872Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.828228Z"}]}}