CVE-2018-20303

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-12-20 · updated 2026-06-17
Weakness: CWE-22

Description

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.

Affected products

gogs: before 0.11.82.1218 — fixed in 0.11.82.1218

How to fix

Upgrade to a fixed version: gogs 0.11.82.1218. Check the vendor advisory for mitigations.

References

https://github.com/gogs/gogs/commit/ff93d9dbda5cebe90d86e4b7dfb2c6b8642970ce
https://github.com/gogs/gogs/issues/5558
https://pentesterlab.com/exercises/cve-2018-18925/
https://github.com/gogs/gogs/commit/ff93d9dbda5cebe90d86e4b7dfb2c6b8642970ce
https://github.com/gogs/gogs/issues/5558
https://pentesterlab.com/exercises/cve-2018-18925/

Get alerted when CVE-2018-20303 or the next vulnerability affects your stack