Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint "PUT /repos/:owner/:repo/contents/*" does not require write permissions and allows access with read permission only via repoAssignment(). After passing the permission check, PutContents() invokes UpdateRepoFile(), which results in commit creation and the execution of git push. As a result, a token with read-only permission can be used to modify repository contents. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

Gogs <= 0.13.3 Multiple Vulnerabilities

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint "PUT
    /repos/:owner/:repo/contents/*" does not require write permissions and allows access with read permission
    only via repoAssignment(). After passing the permission check, PutContents() invokes UpdateRepoFile(),
    which results in commit creation and the execution of git push. As a result, a token with read-only
    permission can be used to modify repository contents. This issue has been patched in versions 0.13.4 and
    0.14.0+dev. (CVE-2026-23632)

According to its self-reported version, the instance of Gogs running on the remote host is prior or equal to 0.13.3.
It is, therefore, affected by multiple vulnerabilities, including:

  - Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. (CVE-2025-8110)

  - Due to the insufficient patch for CVE-2024-56731, it is still possible to update files in the .git directory and     achieve remote command execution. (CVE-2025-64111)

  - An arbitrary file read/write via path traversal exists in Git hook editing. (CVE-2026-23633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
437603	SCA: security update for gogs.io/gogs (GHSA-5qhx-gwfj-6jqr)	Tenable Cloud Security	SCA Checks	medium
437603	SCA: security update for gogs.io/gogs (GHSA-5qhx-gwfj-6jqr)	Tenable Self-Hosted Container Security	SCA Checks	medium
286268	Gogs <= 0.13.3 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-23632

medium

Tenable Plugins

Coming Soon

medium

medium

critical