CVE-2022-0415
Gogs ≤ 0.12.6
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2022-0415 is a high-severity Improper Input Validation (CWE-20) vulnerability in Gogs Gogs. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2022-0415 is a remote command execution vulnerability affecting the repository file upload functionality in Gogs versions prior to 0.12.6. The flaw stems from insufficient input validation (CWE-20) and unrestricted upload of files with dangerous types (CWE-434), allowing an attacker to supply a malicious file that results in arbitrary command execution on the server. It carries a CVSS 3.1 base score of 8.8 with network attack vector, low complexity, and low privileges required.
An authenticated user with repository write access can exploit the issue over the network by uploading a crafted file during the repository file upload process. Successful exploitation grants the attacker full control over confidentiality, integrity, and availability on the affected Gogs instance, enabling execution of arbitrary operating-system commands.
Public references point to the corrective commit in the Gogs repository and the associated huntr.dev disclosure; the recommended mitigation is to upgrade to version 0.12.6 or later, which contains the fix for the upload handling logic.
The EPSS score remains elevated, with a current value of 0.8961 and a recorded peak of 0.9030, indicating sustained exploitation interest following disclosure.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2022-1322
Vulnerability Data
Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
- CWE(s)
Related Threats
Likely ATT&CK TechniquesAI
Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of all input (including uploaded repository files) to reject malformed or dangerous content before processing.
Mandates malicious-code scanning and blocking at upload points, preventing execution of attacker-supplied files that trigger RCE.
Enforces least-functionality restrictions on allowed file types and upload behaviors, eliminating the unrestricted dangerous-file upload vector.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Restricting execution of unauthorized software directly blocks dangerous uploaded files from running.
Secure SDLC practices directly require and enforce input validation during development.
Hardened configuration baselines can enforce allowed file types and processing rules.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Testing against a defined set of requirements and using code review plus vulnerability scanning forces validation of inputs and handling of unanticipated conditions, reducing the chance that malformed data will be accepted.
Secure-coding guidelines and mandatory security testing (including code scans) compel developers to validate and sanitize inputs at design and implementation time, lowering the incidence of malformed or malicious data reaching downstream components.
Mandating input controls that include integrity checks and input validation ensures that untrusted data is examined before use, blocking the root cause of many injection and malformed-data weaknesses.
Security-by-design principles explicitly call for data validation and sanitization at every layer, reducing the chance that malformed or malicious input will be processed without scrutiny.
Requiring language-specific secure coding standards, peer review, SAST and documented mitigation of common programming errors forces validation of all inputs before they are trusted.
Mandated testing for malicious content and known vulnerabilities reduces the likelihood that an outsourced component will contain or accept dangerous file types that could later be uploaded or executed.