How severe is CVE-2022-1884?

CVE-2022-1884 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2022-1884 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (76th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2022-1884?

CVE-2022-1884 affects Gogs. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2022-1884?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

Does CVE-2022-1884 have an EU (EUVD) identifier?

Yes. CVE-2022-1884 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2022-6003.

When was CVE-2022-1884 published?

CVE-2022-1884 was published on 2024-11-15 and last updated on 2026-06-17.

CVE-2022-1884

CVE-2022-1884 is a critical-severity vulnerability in Gogs with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-77.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 2% (76th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2022-6003
Weakness: CWE-77
Affected product: Gogs
Published: 2024-11-15
Last modified: 2026-06-17

Description

A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allowing them to write or rewrite the `.git/config` file. If the `core.sshCommand` is set, this can lead to remote command execution.

Frequently asked questions

What is CVE-2022-1884?: A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upload a file into the .git directory, allowing them to write or rewrite the `.git/config` file. If the `core.sshCommand` is set, this can lead to remote command execution.
How severe is CVE-2022-1884?: CVE-2022-1884 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2022-1884 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 2% (76th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2022-1884?: CVE-2022-1884 affects Gogs. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2022-1884?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2022-1884 have an EU (EUVD) identifier?: Yes. CVE-2022-1884 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2022-6003.
When was CVE-2022-1884 published?: CVE-2022-1884 was published on 2024-11-15 and last updated on 2026-06-17.

References

https://huntr.com/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b

Affected products (1)

cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*

More vulnerabilities in Gogs

CVE-2024-56731 — Critical (CVSS 10.0): Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the…
CVE-2024-39932 — Critical (CVSS 9.9): Gogs through 0.13.0 allows argument injection during the previewing of changes.
CVE-2024-39931 — Critical (CVSS 9.9): Gogs through 0.13.0 allows deletion of internal files.
CVE-2024-39930 — Critical (CVSS 9.9): The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code…
CVE-2026-25242 — Critical (CVSS 9.8): Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints…
CVE-2025-64111 — Critical (CVSS 9.8): Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, due to the insufficient patch for…

All CVEs affecting Gogs →

Other CWE-77 (Command Injection) vulnerabilities

CVE-2026-23652 — Critical (CVSS 10.0): Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an…
CVE-2025-59818 — Critical (CVSS 10.0): This vulnerability allows authenticated attackers to execute arbitrary commands on the underlying system using the file…
CVE-2025-64093 — Critical (CVSS 10.0): Remote Code Execution vulnerability that allows unauthenticated attackers to inject arbitrary commands into the…
CVE-2025-64090 — Critical (CVSS 10.0): This vulnerability allows authenticated attackers to execute commands via the hostname of the device.
CVE-2025-61492 — Critical (CVSS 10.0): A command injection vulnerability in the execute_command function of terminal-controller-mcp 0.1.7 allows attackers to…
CVE-2025-10035 — Critical (CVSS 10.0): A deserialization vulnerability in the License Servlet of Fortra's GoAnywhere MFT allows an actor with a validly forged…

Browse all CWE-77 (Command Injection) vulnerabilities →