{"id":"CVE-2022-2024","aliases":["EUVD-2023-0760","GHSA-pfvh-p8qp-9ww9","GO-2023-1596"],"status":"published","title":"OS Command Injection in gogs/gogs","description":"OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.","severity":{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.97839,"percentile":0.99907,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-78"],"published":"2023-02-25T00:00:00Z","modified":"2026-10-28T02:31:05Z","fixes":[{"ecosystem":"Go","package":"gogs.io/gogs","fixed_in":["0.12.11"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"gogs.io/gogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.12.11"}]}]},{"source":"osv","ecosystem":"Go","package":"gogs.io/gogs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.12.11"}]}]},{"source":"osv","ecosystem":"Go","package":"gogs.io/gogs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.12.11"}]}]}],"products":[{"vendor":"gogs","product":"gogs"},{"vendor":"gogs","product":"gogs/gogs"}],"references":[{"url":"https://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97","tags":["x_transferred","Exploit","Patch","web"]},{"url":"https://github.com/gogs/gogs/commit/15d0d6a94be0098a8227b6b95bdf2daed105ec41","tags":["x_transferred","Patch","fix","web"]},{"url":"https://github.com/gogs/gogs/security/advisories/GHSA-pfvh-p8qp-9ww9","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-2024","tags":["advisory"]},{"url":"https://github.com/gogs/gogs/issues/7030","tags":["web"]},{"url":"https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129","tags":["web"]},{"url":"https://github.com/advisories/GHSA-pfvh-p8qp-9ww9"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/2xxx/CVE-2022-2024.json","tags":["advisory"]},{"url":"https://github.com/gogs/gogs","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-2024","title":"OS Command Injection in gogs/gogs","description":"OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.","status":"published","published":"2023-02-25T00:00:00Z","modified":"2025-03-11T15:39:29.12Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:32.495407Z"}],"euvd":[{"id":"EUVD-2023-0760","description":"OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.","status":"published","published":"2023-02-25T00:00:00Z","modified":"2025-03-11T15:39:29Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:53:07.779422Z"}],"ghsa":[{"id":"GHSA-pfvh-p8qp-9ww9","title":"Gogs OS Command Injection vulnerability","description":"### Impact\n\nThe malicious user is able to update a crafted `config` file into repository's `.git` directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) on case-insensitive file systems (Windows, macOS, etc.) are affected.\n\n### Patches\n\nMake sanitization of upload path to `.git` directory to be case-insensitive. Users should upgrade to 0.12.11 or the latest 0.13.0+dev.\n\n### Workarounds\n\nDisable [repository upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129).\n\n### References\n\nhttps://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7030.\n","status":"published","published":"2023-02-28T20:12:11Z","modified":"2023-03-09T15:32:01Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:36:47.279442Z"}],"nvd":[{"id":"CVE-2022-2024","description":"OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.","status":"published","published":"2023-02-25T08:15:09.817Z","modified":"2026-06-17T04:41:09.153Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:07:36.601381Z"}],"osv":[{"id":"CVE-2022-2024","title":"OS Command Injection in gogs/gogs","description":"OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11.","status":"published","published":"2023-02-25T00:00:00Z","modified":"2026-10-28T02:31:05.219281096Z","cvss":[{"version":"3.0","score":9.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"GHSA-pfvh-p8qp-9ww9","title":"Gogs OS Command Injection vulnerability","description":"### Impact\n\nThe malicious user is able to update a crafted `config` file into repository's `.git` directory in combination with crafted file deletion to gain SSH access to the server on case-insensitive file systems. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) on case-insensitive file systems (Windows, macOS, etc.) are affected.\n\n### Patches\n\nMake sanitization of upload path to `.git` directory to be case-insensitive. Users should upgrade to 0.12.11 or the latest 0.13.0+dev.\n\n### Workarounds\n\nDisable [repository upload](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129).\n\n### References\n\nhttps://huntr.dev/bounties/18cf9256-23ab-4098-a769-85f8da130f97/\n\n### For more information\n\nIf you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7030.\n","status":"published","published":"2023-02-28T20:12:11Z","modified":"2024-08-20T20:58:40.866183Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:46:53.244788Z"},{"id":"GO-2023-1596","title":"Gogs OS Command Injection vulnerability in gogs.io/gogs","description":"Gogs OS Command Injection vulnerability in gogs.io/gogs","status":"published","published":"2024-08-20T20:29:14Z","modified":"2026-03-03T04:53:25.941688Z","updated_at":"2026-11-02T15:47:01.185262Z"}]}}