Gogs
gogs.ioLightweight self-hosted git platform, written in Go.
- Homepage: gogs.io
- GitHub: github.com/gogs/gogs
- Web info: web-check.xyz/check/gogs.io
Gogs Source Code
Author
Description
The painless way to host your own Git service
Homepage
https://gogs.ioLicense
MIT
Created
12 Feb 14
Last Updated
17 Jun 26
Latest version
Primary Language
Go
Size
212,424 KB
Stars
47,609
Forks
5,070
Watchers
47,609
Language Usage
Star History
Top Contributors
-
@unknwon (4023)
-
@dependabot[bot] (282)
-
@lunny (217)
-
@fuxiaohei (179)
-
@slene (107)
-
@codeskyblue (65)
-
@dependabot-preview[bot] (61)
-
@psmit (50)
-
@nanoant (35)
-
@bkcsoft (33)
-
@andreynering (31)
-
@nussjustin-hmmh (27)
-
@fanningert (27)
-
@0rax (26)
-
@fnkr (24)
-
@sapk (19)
-
@nussjustin (18)
-
@compressed (17)
-
@crystaldust (16)
-
@Copilot (16)
-
@0xBAADF00D (14)
-
@makhov (13)
-
@deepsource-autofix[bot] (13)
-
@acusti (12)
-
@strk (12)
-
@genedna (11)
-
@odinuge (11)
-
@chriswatt (11)
-
@crohr (11)
-
@manfer (11)
-
@lstahlman (11)
-
@Gibheer (11)
-
@mhartkorn (10)
-
@soudy (10)
-
@tstorch (9)
-
@donbowman (8)
-
@lanceju (8)
-
@angus-g (7)
-
@m0sth8 (7)
-
@wqweto (7)
-
@allonsy (6)
-
@jcracknell (6)
-
@linquize (6)
-
@alimy (6)
-
@jacksonpan (6)
-
@Stefan-Code (5)
-
@jamesa (5)
-
@wuhan005 (5)
-
@laofo (5)
-
@fundon (5)
-
@evolvedlight (5)
-
@nicolai86 (5)
-
@chadoe (5)
-
@andmarios (5)
-
@exmex (5)
-
@barracks510 (5)
-
@ogarcia (4)
-
@chk1 (4)
-
@rokuu (4)
-
@kakwa (4)
-
@tboerger (4)
-
@DblK (4)
-
@roblabla (4)
-
@psaavedra (4)
-
@michaelboke (4)
-
@llikeitt (4)
-
@denghongcai (4)
-
@eryx (4)
-
@ciarand (4)
-
@achilleas-k (4)
-
@moltam (3)
-
@Preovaleo (3)
-
@crackcomm (3)
-
@eightpigs (3)
-
@imgbot[bot] (3)
-
@leonklingele (3)
-
@m2nlight (3)
-
@zhsso (3)
-
@comminux (3)
-
@tonivj5 (3)
-
@richmahn (3)
-
@pbor (3)
-
@ndarilek (3)
-
@jxshin (3)
-
@thehowl (3)
-
@djcas9 (3)
-
@diseaz (3)
-
@arthuroy (3)
-
@hochhaus (3)
-
@aaronjwood (3)
-
@Supme (3)
-
@aboron (2)
-
@alpencrossi (2)
-
@atzoum (2)
-
@Dennis-Smurf (2)
-
@dlob (2)
-
@euank (2)
-
@norajam (2)
-
@Boc-chi-no (2)
-
@billiegoose (2)
Recent Commits
-
chore(deps-dev): bump vite from 8.0.13 to 8.0.16 (#8367) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
-
web: remove the install page (#8350)
-
web: use a single landing banner for light and dark mode (#8344)
-
chore: update SHA256 checksum link in release issue templates (#8345) [skip ci]
-
fix: surface 5xx errors in the SPA boot and route loaders (#8343)
-
release: cut CHANGELOG entries for 0.14.3 (#8338) [skip ci]
-
chore: update CHANGELOG for removed custom templates [skip ci]
-
security: require token auth for org metadata and team list (#8336)
-
security: time out stalled SSH handshakes after 15s (#8335)
-
security: reject path traversal in owner and repository names (#8334)
-
security: verify content hash on LFS dedupe shortcut (#8333)
-
security: walk full upload path for symlinks (#8332)
-
security: harden Git HTTP access checks (#8331)
-
security: upgrade notebookjs and route ipynb HTML through DOMPurify (#8330)
-
security: enforce RESET_PASSWORD_CODE_LIVES on reset tokens (#8328)
-
security: require admin for repo settings API endpoints (#8327)
-
security: restrict ipynb sanitizer to safe image data URIs (#8326)
-
security: sanitize milestone names in new issue form (#8325)
-
Jonah Burgess (06 Jun 26)
security: fix argument injection in pull request merge (rebase) (#8301) Co-authored-by: Jonah Burgess <[email protected]> Co-authored-by: Joe Chen <[email protected]>
-
security: close SSRF in repository migration and recurring mirror sync (#8324)
-
database: bound collaboration access mode by `min(actor, admin)` (#8227) Co-authored-by: Joe Chen <[email protected]>
-
security: harden same-site URL check against redirect bypass (#8322)
-
repository: validate remote address on mirror address update (#8225) Signed-off-by: E99p1ant <[email protected]> Co-authored-by: Joe Chen <[email protected]>
-
chore: update agents matter
-
security: require POST for org team and member actions (#8321)
-
security: enforce repo access on attachment download (#8320)
-
security: upgrade marked.js to 4.3.0 (#8319)
-
web: enable @pierre/diffs worker pool to fix blank flashes on fast diff scroll (#8317)
-
Robert Silén (03 Jun 26)
docs: document MariaDB support (#8260) Co-authored-by: ᴊᴏᴇ ᴄʜᴇɴ <[email protected]>
-
chore: delete digitalocean_gc workflow (#8315)
Gogs Security
Security Advisories (41)
- high Patched CVSS 7.3
CVE-2026-26276 DOM-based XSS via milestone selection
- medium Patched
CVE-2026-26196 Access tokens get exposed through URL params in API requests
- medium Patched
CVE-2026-26195 Stored XSS in branch and wiki views through author and committer names
- high Patched
CVE-2026-26194 Release tag option injection in release deletion
- high Patched CVSS 8.7
CVE-2026-26022 Stored XSS via data URI in issue comments
- medium Patched
CVE-2026-25229 Authorization bypass allows cross-repository label modification
- medium Patched
CVE-2026-25120 Cross-repository comment deletion
- medium Patched CVSS 6.5
CVE-2026-23633 Arbitrary file read/write via path traversal in Git hook editing
- medium Patched CVSS 6.5
CVE-2026-23632 Update repository content via API with read-only permission
- high Patched
CVE-2026-24135 Arbitrary file deletion via path traversal in wiki page update
- medium Patched CVSS 6.5
CVE-2026-22592 DoS in repository mirror sync
- critical Patched
CVE-2026-25232 Protected branch bypass in web UI
- medium Patched
CVE-2025-65852 Authorization bypass in repository deletion API
- high Patched CVSS 7.3
GHSA-26gq-grmh-6xm6 Stored XSS via Mermaid diagrams
- medium Patched
CVE-2026-25242 Unauthenticated file upload
- high Patched
CVE-2025-64175 2FA bypass via recovery code
- critical Patched
CVE-2025-64111 RCE in repository put contents API
- critical Patched CVSS 10
CVE-2024-56731 Deletion of internal files allows remote command execution
- high Patched CVSS 7.7
CVE-2024-39933 Argument Injection when tagging new releases
- critical Patched CVSS 9.9
CVE-2024-39932 Argument Injection during changes preview
- critical Patched CVSS 9.9
CVE-2024-39931 Deletion of internal files
- critical Patched CVSS 9.9
CVE-2024-39930 Argument Injection in the built-in SSH server
- critical Patched
CVE-2024-55947 Path Traversal in file update API
- critical Patched
CVE-2024-54148 Path Traversal in file editing UI
- critical Patched CVSS 9.3
CVE-2026-25921 Cross-repository LFS object overwrite via missing content hash verification
- medium Patched CVSS 6.3
CVE-2025-47943 Stored XSS in PDF renderer
- high Patched CVSS 8.5
CVE-2026-52797 Overwriting critical files results in a denial of service
- critical Patched
CVE-2022-2024 OS Command Injection in repo editor on case-insensitive file systems
- critical Patched
CVE-2022-32174 Stored XSS Assignee
- high Patched
CVE-2022-1993 Path Traversal in Git HTTP endpoints
- critical Patched
CVE-2022-1992 Path Traversal in file editor on Windows
- medium Patched
CVE-2022-31038 XSS vulnerability in repository issue list
- critical Patched
CVE-2022-1986 OS Command Injection in file editor
- critical Patched
CVE-2021-32546 Remote Command Execution in file editing
- critical Patched
CVE-2022-1884 OS Command Injection in file uploading
- low Patched
GHSA-pj96-4jhv-v792 XSS in cookies
- high Patched
CVE-2022-1285 SSRF in webhook
- medium Patched
CVE-2022-1464 Stored XSS in issues
- critical Patched
CVE-2022-0415 Remote command execution in file uploading
- medium Patched
CVE-2022-0870 SSRF in repository migration
- medium Patched
CVE-2022-0871 Improper PAM authorization handling
Gogs Website
Website
Introduction - Gogs: A painless self-hosted Git service
The painless way to host your own Git service
Redirects
Redirects to https://gogs.io/getting-started/introduction
Security Checks
All 65 security checks passed
Server Details
- IP Address 76.76.21.21
- Location Walnut, California, United States of America, NA
- ISP Vercel Inc
- ASN AS16509
Associated Countries
-
US
Safety Score
Website marked as safe
100%
Blacklist Check
gogs.io was found on 0 blacklists
- AntiSocial Blacklist
- Artists Against 419
- Badbitcoin
- Bambenek Consulting
- CERT Polska
- CoinBlockerLists
- CRDF
- CryptoScamDB
- EtherAddressLookup
- EtherScamDB
- Fake Website Buster
- MetaMask EthPhishing
- NABP Not Recommended Sites
- OpenPhish
- PetScams
- PhishFeed
- PhishFort
- Phishing.Database
- PhishStats
- PhishTank
- Phishunt
- RPiList Not Serious
- Scam.Directory
- SecureReload Phishing List
- Spam404
- StopGunScams
- Suspicious Hosting IP
- ThreatFox
- ThreatLog
- TweetFeed
- URLhaus
- ViriBack C2 Tracker
Website Preview
Gogs Reviews
More Code Hosting
-
A fully-managed instance of Forgejo.
-
Lightweight self-hosted git platform, written in Go.
-
Fully-featured git, CI and project management platform. Managed instance available, but can also be self-hosted.
-
Git and mercurial code hosting, task management, mailing lists, wiki hosting and Alpine-based build pipelines. Can be self-hosted, or used through the managed instance at sr.ht.
About the Data: Gogs
Change History
- Amended (github) #608
API
You can access Gogs's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/gogsThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share Gogs
Help your friends compare Code Hosting, and pick
privacy-respecting software and services.
Share Gogs and Awesome Privacy with your network!