CVE-2018-18925: Gogs

Critical severity, CVSS 9.8. EPSS: 31.1% chance of exploitation in the next 30 days.

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

Affected products

• Gogs Gogs: up to and including 0.11.66

Published 2018-11-04. Last modified 2026-06-17.