CVE-2020-15867: Gogs git hook feature allows authenticated remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 7.2 with high EPSS and public exploit references, but exploitation requires an authenticated account with hook privileges.

What it is

The git hook feature in Gogs 0.5.5 through 0.12.2 lets an authenticated user execute code on the server. The flaw also enables privilege escalation when hook access is granted to a non-administrative user, and the UI does not warn that the action is unsafe.

Impact

An attacker with a valid account gains remote code execution on the Gogs host, and a low-privileged user can escalate to administrative-level control of the server.

Attack surface

Reachable over the network through the git hook feature; the CVSS vector shows network access with high privileges required and no user interaction.

Exploitation

Not listed in CISA KEV, but EPSS is 0.87416 (99.7th percentile) and references are tagged Exploit, indicating public exploit material exists.

What to do

• Upgrade Gogs past 0.12.2 to a fixed release as the first action.
• Restrict git hook configuration to administrative accounts only.
• Audit and remove hook access from non-administrative users.
• Monitor or disable custom git hooks where the feature is not required.

Detection

• Review Gogs audit logs for hook creation or modification events, especially by non-admin users.
• Inspect repository hook directories for unexpected or recently added scripts.
• Alert on server-side process execution spawned by the Gogs service account.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.