CVE-2022-1884 Remote Command Execution in gogs/gogs

What is CVE-2022-1884?

CVE-2022-1884 is a critical command injection vulnerability in gogs/gogs, published on 15 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allowing them to write or rewrite the `.git/config` file. If the `core.sshCommand` is set, this can lead to remote command execution.

Weakness: CWE-77, CWE-78

Which versions are affected by CVE-2022-1884?

3 open source packages ship an affected version, including gogs.io/gogs. It affects 1 product.

Products include Gogs Gogs.

How do I fix CVE-2022-1884?

Upgrade gogs.io/gogs to 0.12.8 or later.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-1884 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2022-1884 exists.

Other vulnerabilities in gogs/gogs

• CVE-2025-8110 Gogs Path Traversal Exploited High 8.7
• CVE-2024-56731 Gogs deletion of internal files allows remote command execution Critical 10.0
• CVE-2022-1986 OS Command Injection in gogs/gogs Critical 10.0
• CVE-2022-1992 Path Traversal in gogs/gogs Critical 10.0
• CVE-2024-39930 Duplicate Advisory: github.com/gogs/gogs affected by CVE-2024-39930 Critical 9.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-958j-443g-7mm7, GO-2022-0749.