CVE-2018-18925

CRITICAL NUCLEI

Gogs < 0.11.66 - Remote Code Execution via Session File Forgery

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2018-18925. PoCs published by j4k0m. A Nuclei detection template is also available.

AI-analyzed exploit summary This PoC exploits a directory traversal vulnerability in Gogs (CVE-2018-18925) to achieve session bypass and RCE via crafted session files and Git hooks. The main.go script generates a serialized session payload to impersonate an administrator.

Description

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

Exploits (2)

nomisec WORKING POC 7 stars
by j4k0m · poc
https://github.com/j4k0m/CVE-2018-18925

This PoC exploits a directory traversal vulnerability in Gogs (CVE-2018-18925) to achieve session bypass and RCE via crafted session files and Git hooks. The main.go script generates a serialized session payload to impersonate an administrator.

Classification
Working Poc 95%
Attack Type
Auth Bypass | Rce
Complexity
Moderate
Reliability
Reliable
Target: Gogs (self-hosted Git service)
No auth needed
Prerequisites: Ability to upload files to a Gogs repository · Knowledge of repository ID and file path structure
devstral-2 · analyzed Feb 16, 2026 Full analysis →
inthewild WORKING POC
poc
https://github.com/ryouyoo/cve-2018-18925

This repository contains a functional exploit for CVE-2018-18925, a directory traversal vulnerability in Gogs leading to session bypass and RCE. The PoC generates a malicious session file to exploit the vulnerability via cookie manipulation and git hooks.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Gogs (self-hosted Git service)
No auth needed
Prerequisites: Ability to upload files to a Gogs repository · Knowledge of repository ID and file paths
devstral-2 · analyzed Feb 23, 2026 Full analysis →

Nuclei Templates (1)

Gogs (Go Git Service) 0.11.66 - Remote Code Execution
CRITICALby princechaddha
Shodan: cpe:"cpe:2.3:a:gogs:gogs" || http.title:"sign in - gogs"
FOFA: title="sign in - gogs"

References (1)

Core 1
Core References
Patch, Third Party Advisory x_refsource_misc
https://github.com/gogs/gogs/issues/5469

Scores

CVSS v3 9.8
EPSS 0.9354
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-384
Status published
Products (1)
gogs/gogs < 0.11.66
Published Nov 04, 2018
Tracked Since Feb 18, 2026