Vulnerability record · CVE-2022-0415 · published 21 March 2022
CVE-2022-0415: Gogs repository file upload allows remote command execution
Gogs · Gogs
Gogs before 0.12.6 fails to properly validate files uploaded to a repository, allowing an authenticated user to achieve remote command execution. The flaw combines improper input validation (CWE-20) with unrestricted file upload (CWE-434), and a public exploit reference exists, making it a practical risk for exposed Gogs instances.
Description
Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8 with low privileges required, no user interaction, and a public exploit reference, though it is not in KEV and requires an authenticated account.
What it is
Gogs before 0.12.6 fails to properly validate files uploaded to a repository, allowing an authenticated user to achieve remote command execution. The flaw combines improper input validation (CWE-20) with unrestricted file upload (CWE-434), and a public exploit reference exists, making it a practical risk for exposed Gogs instances.
Impact
An attacker with a valid low-privileged account can execute arbitrary commands on the server hosting Gogs, leading to full compromise of confidentiality, integrity and availability of that host.
Attack surface
Reached over the network through the repository file upload functionality; the CVSS vector indicates low privileges are required and no user interaction is needed.
Exploitation
Not listed in CISA KEV, but EPSS is very high (0.65237, 99.2nd percentile) and the huntr.dev reference is tagged Exploit, indicating public exploit code is available.
What to do
- Upgrade Gogs to 0.12.6 or later, which contains the patch commit 0fef3c9082269e9a4e817274942a5d7c50617284.
- If immediate upgrade is not possible, restrict repository upload permissions to trusted users and disable or limit the upload feature.
- Place Gogs behind authentication and network controls so only trusted users can reach the upload endpoint.
- Monitor the Gogs host for unexpected child processes or outbound connections originating from the web service account.
Detection
- Review Gogs upload and repository activity logs for unusual or unexpected file uploads, especially executable or script content.
- Alert on process creation events where the Gogs service account spawns shells or system utilities.
- Monitor for outbound network connections from the Gogs server to unfamiliar hosts.
- Audit accounts with repository write or upload permissions for signs of compromise or misuse.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284 | PatchThird Party Advisory |
| https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902 | ExploitPatchThird Party Advisory |
| https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284 | PatchThird Party Advisory |
| https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902 | ExploitPatchThird Party Advisory |
Track CVE-2022-0415 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2022-0415), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
