CVE-2018-18925

CRITICAL NUCLEI

Gogs < 0.11.66 - Remote Code Execution

Title source: rule

Description

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

Exploits (2)

nomisec WORKING POC 7 stars
by j4k0m · poc
https://github.com/j4k0m/CVE-2018-18925
inthewild WORKING POC
poc
https://github.com/ryouyoo/cve-2018-18925

Nuclei Templates (1)

Gogs (Go Git Service) 0.11.66 - Remote Code Execution
CRITICALby princechaddha
Shodan: cpe:"cpe:2.3:a:gogs:gogs" || http.title:"sign in - gogs"
FOFA: title="sign in - gogs"

References (1)

Scores

CVSS v3 9.8
EPSS 0.9357
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-384
Status published
Products (1)
gogs/gogs < 0.11.66
Published Nov 04, 2018
Tracked Since Feb 18, 2026