CVE-2018-20303
- Source
- https://cve.org/CVERecord?id=CVE-2018-20303
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-20303.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2018-20303
- Aliases
- Published
- 2018-12-20T00:29:00.350Z
- Modified
- 2026-07-08T05:54:31.099012088Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.
- Database specific
{ "unresolved_ranges": [ { "source": "CPE_RANGE", "cpes": [ "cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*" ], "vendor_product": "gogs:gogs", "extracted_events": [ { "fixed": "0.11.82.1218" } ] }, { "source": "DESCRIPTION", "extracted_events": [ { "fixed": "0.11.82.1218" } ] } ] }- References
Affected packages
Git / github.com/gogs/gogs
Affected versions
v0.*
v0.10
v0.10.18
v0.10.8
v0.10rc
v0.11
v0.11.19
v0.11.29
v0.11.33
v0.11.34
v0.11.4
v0.11.43
v0.11.53
v0.11.66
v0.11.79
v0.11rc
v0.2.0
v0.3.0
v0.3.1
v0.4.0
v0.4.1
v0.4.2
v0.5.0
v0.5.11
v0.5.13
v0.5.2
v0.5.5
v0.5.8
v0.5.9
v0.6.1
v0.6.15
v0.6.3
v0.6.9
v0.7.0
v0.7.19
v0.7.22
v0.7.33
v0.7.6
v0.8.0
v0.8.10
v0.8.25
v0.8.43
v0.9.0
v0.9.113
v0.9.128
v0.9.13
v0.9.141
v0.9.46
v0.9.48
v0.9.60
v0.9.71
v0.9.97