GitHub Advisoryadvisory · Go

GHSA-9hxg-w7qf-hh93 Gogs Directory Traversal

HIGH Published 2022-05-14 Modified 2026-05-14 Official page ↗
Aliases
CVE-2018-20303
Ecosystem
Go
Packages
gogs.io/gogs
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-22
Reviewed
2023-07-25

Affected packages

• Go gogs.io/gogs: < 0.11.80-0.20181218063808-ff93d9dbda5c → fixed in 0.11.80-0.20181218063808-ff93d9dbda5c

Description

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.

Related

Alias · CVE (1)

  • CVE-2018-20303 In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a… vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References