CVE-2018-20303 — Path Traversal in Gogs

CWE-22 — Path Traversal3 documents3 sources
Severity
7.5HIGHNVD
GHSA9.8OSV9.8
EPSS
2.5%
top 14.72%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Gogs.io GogsGogs
Timeline
PublishedDec 20
Latest updateMay 14

Description

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDgogs/gogs< 0.11.82.1218
▶Gogogs.io/gogs< 0.11.82.1218

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
OSV
Gogs Directory Traversal↗2022-05-14
▶
GHSA
Gogs Directory Traversal↗2022-05-14
▶