PT-2025-26689 · Pdf.Js+1 · Pdf.Js+1

Edoardottt · Published 2025-06-24 · Updated 2025-08-04 · CVE-2025-47943

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Gogs versions 0.14.0+dev and prior

Description: Gogs is an open source self-hosted Git service. The issue is a stored cross-site scripting (XSS) vulnerability, which allows client-side Javascript code execution. This is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20, located in public/plugins/.

Recommendations: For versions 0.14.0+dev and prior, update to version 0.13.3 or later to resolve the issue. As a temporary workaround, consider disabling the pdfjs-1.4.20 component under public/plugins/ until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-47943

GHSA-XH32-CX6C-CP4V

GO-2025-3778

OPENSUSE-SU-2025:15405-1

Affected Products

Gogs

Pdf.Js

References · 71

• 🔥 https://github.com/gogs/gogs/security/advisories/GHSA-xh32-cx6c-cp4v · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/47xxx/CVE-2025-47943.json · Exploit
• https://osv.dev/vulnerability/GO-2025-3778 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-xh32-cx6c-cp4v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-47943 · Security Note
• https://osv.dev/vulnerability/CVE-2025-47943 · Vendor Advisory
• https://github.com/gogs/gogs · Note
• https://github.com/gogs/gogs/releases/tag/v0.13.3 · Note
• https://github.com/gogs/gogs/commit/110117b2e5e5baa4809c819bec701e929d2d8d40 · Note
• https://suse.com/security/cve/CVE-2025-46702 · Note
• https://suse.com/security/cve/CVE-2024-44906 · Note
• https://suse.com/security/cve/CVE-2025-3227 · Note
• https://t.me/cvenotify/126454 · Telegram Post
• https://suse.com/security/cve/CVE-2025-53633 · Note