CVE-2018-18925
CVE-2018-18925 is a critical-severity vulnerability in Gogs with a CVSS 3.x base score of 9.8. Its EPSS exploit-prediction score of 31% places it in the 98th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-384.
Key facts
- Severity: Critical (CVSS 3.x base score 9.8)
- CVSS v2: 7.5
- EPSS exploit prediction: 31% (98th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-384
- Affected product: Gogs
- Published:
- Last modified:
Description
Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.
Frequently asked questions
- What is CVE-2018-18925?
- Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.
- How severe is CVE-2018-18925?
- CVE-2018-18925 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2018-18925 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 31% (98th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2018-18925?
- CVE-2018-18925 affects Gogs. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2018-18925?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2018-18925 published?
- CVE-2018-18925 was published on 2018-11-04 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*
More vulnerabilities in Gogs
- CVE-2024-56731 — Critical (CVSS 10.0): Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the…
- CVE-2024-39932 — Critical (CVSS 9.9): Gogs through 0.13.0 allows argument injection during the previewing of changes.
- CVE-2024-39931 — Critical (CVSS 9.9): Gogs through 0.13.0 allows deletion of internal files.
- CVE-2024-39930 — Critical (CVSS 9.9): The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code…
- CVE-2026-25242 — Critical (CVSS 9.8): Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints…
- CVE-2025-64111 — Critical (CVSS 9.8): Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for…
Other CWE-384 (Session Fixation) vulnerabilities
- CVE-2024-11317 — Critical (CVSS 10.0): Session Fixation vulnerabilities allow an attacker to fix a users session identifier before login providing an…
- CVE-2024-38513 — Critical (CVSS 10.0): Fiber is an Express-inspired web framework written in Go A vulnerability present in versions prior to 2.52.5 is a…
- CVE-2021-20151 — Critical (CVSS 10.0): Trendnet AC2600 TEW-827DRU version 2.08B01 contains a flaw in the session management for the device. The router's…
- CVE-2026-18527 — Critical (CVSS 9.9): IBM Administration Runtime Expert for i 1R1M0 IBM Application Runtime Expert (ARE) for i could allow a remote attacker…
- CVE-2026-102489 — Critical (CVSS 9.8): Zammad versions 6.3.0 to 6.5.4 are vulnerable a session hijack vulnerability that leads to remote code execution as the…
- CVE-2026-92609 — Critical (CVSS 9.8): Session fixation in HTTP management authentication allows remote attackers to gain unauthorized access to an…