{"id":"CVE-2022-0415","published":"2022-03-21T10:45:13Z","modified":"2024-08-02T23:25:40Z","title":"Remote Command Execution in uploading repository file in gogs/gogs","vendor":"gogs","product":"gogs/gogs","tier":"core","eol":null,"affectedVersions":[{"vendor":"gogs","product":"gogs/gogs","versions":[">= unspecified, < 0.12.6"]}],"description":{"text":"Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.","provenance":"source","from":"CVE.org"},"summary":{"text":"A remote command execution flaw in the repository file upload functionality of gogs/gogs, the self-hosted Git service, affects versions prior to 0.12.6. An attacker with network access and low-privilege authenticated access to the service can exploit improper input validation during file uploads to execute commands, with the impact extending beyond the vulnerable component itself.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:12:19Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.65935,"percentile":0.9927,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://huntr.dev/bounties/b4928cfe-4110-462f-a180-6d5673797902","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/gogs/gogs/commit/0fef3c9082269e9a4e817274942a5d7c50617284","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.12.6"],"patched":["0.12.6"],"from":["GHSA-5gjh-5j4f-cpwv","GO-2022-0554"],"provenance":"source"}],"advisories":[{"id":"GHSA-5gjh-5j4f-cpwv","url":"https://github.com/advisories/GHSA-5gjh-5j4f-cpwv","severity":"HIGH","ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.12.6"],"patched":["0.12.6"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-1322","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-1322","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2022-0415","name":"Gogs <0.12.6 - Remote Command Execution","severity":"high","path":"http/cves/2022/CVE-2022-0415.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-0415.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2022-03-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2022-0415","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":31.8,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.85,"detail":"percentile 0.9927"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2020-14958","published":"2020-06-21","fixed":"0.12.0","kev":false},{"cve":"CVE-2022-0870","published":"2022-03-11","fixed":"0.12.5","kev":false,"link":{"from":"CVE-2022-0870","to":"CVE-2022-0415","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:gogs.io/gogs","fromFixed":"0.12.5","toFixed":"0.12.6","daysApart":10},{"kind":"similar","provenance":"machine","score":0.3,"basis":"same product + description similarity"}]}},{"cve":"CVE-2022-0871","published":"2022-03-11","fixed":"0.12.5","kev":false},{"cve":"CVE-2022-0415","published":"2022-03-21","fixed":"0.12.6","kev":false},{"cve":"CVE-2022-1464","published":"2022-05-05","fixed":"0.12.7","kev":false,"link":{"from":"CVE-2022-0415","to":"CVE-2022-1464","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:gogs.io/gogs","fromFixed":"0.12.6","toFixed":"0.12.7","daysApart":45}]}},{"cve":"CVE-2021-32546","published":"2022-05-31","fixed":"0.12.8","kev":false},{"cve":"CVE-2022-1285","published":"2022-06-01","fixed":"0.12.8","kev":false}],"package":"Go:gogs.io/gogs"}}