CVE-2022-1986

CRITICAL

OS Command Injection in file editor in Gogs

Published June 8, 2022Updated August 21, 2024Source: osv

Summary

### Impact The malicious user is able to update a crafted `config` file into repository's `.git` directory in combination with crafted file deletion to gain SSH access to the server. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected. ### Patches File deletions are prohibited to repository's `.git` directory. Users should upgrade to 0.12.9 or the latest 0.13.0+dev. ### Workarounds N/A ### References https://huntr.dev/bounties/776e8f29-ff5e-4501-bb9f-0bd335007930/ ### For more information If you have any questions or comments about this advisory, please post on #7000.

Remediation

Upgrade to the fixed version using your package manager.

Update gogs.io/gogs to 0.12.9 or later

go get gogs.io/gogs@v0.12.9

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Package	Ecosystem	Affected	Fixed In
gogs.io/gogs	go	All versions	0.12.9

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-78
OS Command InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2022-1986?: OS Command Injection in file editor in Gogs This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2022-1986?: CVE-2022-1986 affects gogs.io/gogs. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2022-1986 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-67mx-jc2f-jgjm

GO-2022-0556

Related CVEs

CVE-2026-52811
CRITICAL
Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym
CVE-2024-39932
CRITICAL
Gogs allows argument injection during the previewing of changes
CVE-2026-52813
CRITICAL
Gogs has Path Traversal in organization name that results in RCE through Git hooks
CVE-2026-25921
CRITICAL
Gogs: Cross-repository LFS object overwrite via missing content hash verification
CVE-2025-64111
CRITICAL
Gogs's update .git/config file allows remote command execution
CVE-2026-52805
HIGH
Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft
CVE-2025-8110
HIGH
Gogs vulnerable to a bypass of CVE-2024-55947
CVE-2026-52816
MEDIUM
Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies