CVE-2018-20303: Gogs Directory Traversal

May 14, 2022 (updated May 14, 2026)

In pkg/tool/path.go in Gogs before 0.11.82.1218, a directory traversal in the file-upload functionality can allow an attacker to create a file under data/sessions on the server, a similar issue to CVE-2018-18925.

References

github.com/advisories/GHSA-9hxg-w7qf-hh93
github.com/gogs/gogs/commit/ff93d9dbda5cebe90d86e4b7dfb2c6b8642970ce
github.com/gogs/gogs/issues/5558
nvd.nist.gov/vuln/detail/CVE-2018-20303
pentesterlab.com/exercises/cve-2018-18925

Code Behaviors & Features

Detect and mitigate CVE-2018-20303 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →