CVE-2018-18925 Path traversal in n/a

What is CVE-2018-18925?

CVE-2018-18925 is a critical path traversal vulnerability in n/a, published on 4 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

Weakness: CWE-384

Which versions are affected by CVE-2018-18925?

It affects 1 product.

Products include Gogs Gogs.

How do I fix CVE-2018-18925?

No fix has been published for CVE-2018-18925 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2018-18925 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-18925 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2025-8110 Gogs Path Traversal Exploited High 8.7
• CVE-2024-56731 Gogs deletion of internal files allows remote command execution Critical 10.0
• CVE-2022-1884 Remote Command Execution in gogs/gogs Critical 10.0
• CVE-2022-1986 OS Command Injection in gogs/gogs Critical 10.0
• CVE-2022-1992 Path Traversal in gogs/gogs Critical 10.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CVE-2018-1000853, GHSA-59hg-cj84-76w9.