CVE-2018-18925

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

Affected products

Gogs

Gogs

≤ 0.11.66

CVSS 3.0

9.8 CRITICAL

EPSS

31.1% (98th percentile)

Weakness

CWE-384

NVD status

Modified

Published

2018-11-04