PT-2026-23486 · Gogs · Gogs

Rezmoss · Published 2026-02-13 · Updated 2026-03-25 · CVE-2026-26195

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.2

Description Gogs, a self-hosted Git service, contains a stored cross-site scripting (XSS) issue due to unsafe template rendering. The issue arises from mixing user input with permissive sanitizer handling of data URLs and the use of the safe() function, which disables escaping. Specifically, committer names on branch pages and arguments within locale files are vulnerable to injection. An attacker who can inject commit metadata, such as author or committer name, can trigger script execution on affected pages, potentially leading to session abuse, Cross-Site Request Forgery (CSRF) token theft, or unauthorized actions. The safe() function in internal/template/template.go allows bypassing escaping mechanisms. The vulnerability is present in templates/repo/branches/overview.tmpl, templates/repo/branches/all.tmpl, and templates/repo/wiki/view.tmpl. The locale file conf/locale/locale en-US.ini also contributes to the issue by injecting raw arguments.

Recommendations Update to version 0.14.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-06147

CVE-2026-26195

GHSA-VGVF-M4FW-938J

GO-2026-4618

SUSE-SU-2026:1042-1

Affected Products

Gogs

References · 139

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26195.json · Exploit
• https://github.com/gogs/gogs/commit/ac21150a53bef3a3061f4da787ab193a8d68ecfc · Patch
• https://github.com/gogs/gogs/security/advisories/GHSA-vgvf-m4fw-938j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26195 · Security Note
• https://osv.dev/vulnerability/CVE-2026-26195 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vgvf-m4fw-938j · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4618 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06147 · Security Note
• https://github.com/gogs/gogs · Note
• https://github.com/gogs/gogs/releases/tag/v0.14.2 · Note
• https://github.com/gogs/gogs/pull/8176 · Note
• https://suse.com/security/cve/CVE-2026-28280 · Note
• https://suse.com/security/cve/CVE-2026-22728 · Note
• https://suse.com/security/cve/CVE-2026-32319 · Note