Vulnerability GO-2026-5712
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 months ago
June 25, 2026 at 10:34 PM UTC
Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs
*
*
Summary
Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs
Details
Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: gogs.io/gogs before v0.14.3.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Unknown
4 months ago
Gogs has Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion) in gogs.io/gogs
* GO-2026-5765
* GO-2026-5765
Unknown
4 months ago
Gogs has an Open Redirect via redirect_to in gogs.io/gogs
* GO-2026-5773
* GO-2026-5773
Unknown
4 months ago
Gogs has DOM-based XSS via Milestone Name on New Issue Page in gogs.io/gogs
* GO-2026-5661
* GO-2026-5661
Unknown
4 months ago
Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers in gogs.io/gogs
* GO-2026-5695
* GO-2026-5695
Unknown
4 months ago
Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs
* GO-2026-5724
* GO-2026-5724
Impacted packages
Timeline
Published
4 months ago
June 25, 2026 at 10:34 PM UTC
Last Modified
10 hours ago
November 05, 2026 at 09:41 PM UTC