Cyber Resilience

CVE-2022-0415

Gogs ≤ 0.12.6

Public PoCHigh EPSS
Published
21 March 2022
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.65 99.2th percentile
Risk Priority 87 floored blend · peak EPSS

Summary

CVE-2022-0415 is a high-severity Improper Input Validation (CWE-20) vulnerability in Gogs Gogs. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2022-0415 is a remote command execution vulnerability affecting the repository file upload functionality in Gogs versions prior to 0.12.6. The flaw stems from insufficient input validation (CWE-20) and unrestricted upload of files with dangerous types (CWE-434), allowing an attacker to supply a malicious file that results in arbitrary command execution on the server. It carries a CVSS 3.1 base score of 8.8 with network attack vector, low complexity, and low privileges required.

An authenticated user with repository write access can exploit the issue over the network by uploading a crafted file during the repository file upload process. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability on the affected Gogs instance, enabling execution of arbitrary operating-system commands.

Public references point to the corrective commit in the Gogs repository and the associated huntr.dev disclosure; the recommended mitigation is to upgrade to version 0.12.6 or later, which contains the fix for the upload handling logic.

The EPSS score remains elevated, with a current value of 0.8961 and a recorded peak of 0.9030, indicating sustained exploitation interest following disclosure.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.

CWE(s)

Related Threats

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
The vulnerability is a remote command execution flaw in a public-facing web application (Gogs repository file upload), directly enabling exploitation of a public-facing application.
T1059 Command and Scripting Interpreter Executionconfidence: HIGH
Successful exploitation results in arbitrary operating-system command execution on the server.
T1105 Ingress Tool Transfer Command And Controlconfidence: MEDIUM
The attack vector involves uploading a crafted file to the server, which is a form of ingress tool transfer.
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-3488Shared CWE-20, CWE-434
CVE-2025-64759Shared CWE-20, CWE-434
CVE-2023-39539Shared CWE-20, CWE-434
CVE-2026-27891Shared CWE-20, CWE-434
CVE-2024-47823Shared CWE-20, CWE-434
CVE-2025-22137Shared CWE-20, CWE-434
CVE-2021-34427Shared CWE-20, CWE-434
CVE-2023-39538Shared CWE-20, CWE-434
CVE-2023-20009Shared CWE-20, CWE-434
CVE-2023-2071Shared CWE-20, CWE-434

Affected Assets

gogs
gogs
≤ 0.12.6

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • SI-10 Information Input Validation
  • SI-3 Malicious Code Protection
  • CM-7 Least Functionality
Detect
Catch it (NIST detect / respond)
  • SI-3 Malicious Code Protection
Harden
Shrink the surface (DISA STIG)
  • 6 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V5.1.1

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly requires validation of all input (including uploaded repository files) to reject malformed or dangerous content before processing.

preventdetect

Mandates malicious-code scanning and blocking at upload points, preventing execution of attacker-supplied files that trigger RCE.

prevent

Enforces least-functionality restrictions on allowed file types and upload behaviors, eliminating the unrestricted dangerous-file upload vector.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-05 mostly match
prevents

Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly require and enforce input validation during development.

PR.PS-01 partial match
prevents

Hardened configuration baselines can enforce allowed file types and processing rules.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

detects

Testing against a defined set of requirements and using code review plus vulnerability scanning forces validation of inputs and handling of unanticipated conditions, reducing the chance that malformed data will be accepted.

prevents

Secure-coding guidelines and mandatory security testing (including code scans) compel developers to validate and sanitize inputs at design and implementation time, lowering the incidence of malformed or malicious data reaching downstream components.

prevents

Mandating input controls that include integrity checks and input validation ensures that untrusted data is examined before use, blocking the root cause of many injection and malformed-data weaknesses.

prevents

Security-by-design principles explicitly call for data validation and sanitization at every layer, reducing the chance that malformed or malicious input will be processed without scrutiny.

prevents

Requiring language-specific secure coding standards, peer review, SAST and documented mitigation of common programming errors forces validation of all inputs before they are trusted.

prevents

Mandated testing for malicious content and known vulnerabilities reduces the likelihood that an outsourced component will contain or accept dangerous file types that could later be uploaded or executed.

References