CVE-2022-1464: Gogs

Medium severity, CVSS 5.4. EPSS: 0.7% chance of exploitation in the next 30 days.

Stored xss bug in GitHub repository gogs/gogs prior to 0.12.7. As the repo is public , any user can view the report and when open the attachment then xss is executed. This bug allow executed any javascript code in victim account .

Affected products

• Gogs Gogs: before 0.12.7 (fixed in 0.12.7)

Published 2022-05-05. Last modified 2026-06-17.