Gogs
gogs.ioLightweight self-hosted git platform, written in Go.
- Homepage:gogs.io
- GitHub:github.com/gogs/gogs
- Web info:web-check.xyz/check/gogs.io
Gogs Source Code
Author
Description
The painless way to host your own Git service
Homepage
https://gogs.ioRepository
- LicenseMIT
- Created12 Feb 14
- Primary languageGo
- Size212,360 KB
- Stars47,730
- Forks5,073
- Watchers47,730
Top Contributors
@unknwon (4030)
@dependabot[bot] (284)
@lunny (217)
@fuxiaohei (179)
@slene (107)
@codeskyblue (65)
@dependabot-preview[bot] (61)
@psmit (50)
@nanoant (35)
@bkcsoft (33)
@andreynering (31)
@nussjustin-hmmh (27)
@fanningert (27)
@0rax (26)
@fnkr (24)
@sapk (19)
@nussjustin (18)
@compressed (17)
@crystaldust (16)
@Copilot (16)
@0xBAADF00D (14)
@makhov (13)
@deepsource-autofix[bot] (13)
@acusti (12)
@strk (12)
@genedna (11)
@odinuge (11)
@chriswatt (11)
@crohr (11)
@manfer (11)
@lstahlman (11)
@Gibheer (11)
@mhartkorn (10)
@soudy (10)
@tstorch (9)
@donbowman (8)
@lanceju (8)
@angus-g (7)
@m0sth8 (7)
@wqweto (7)
@allonsy (6)
@jcracknell (6)
@linquize (6)
@alimy (6)
@jacksonpan (6)
@Stefan-Code (5)
@jamesa (5)
@wuhan005 (5)
@laofo (5)
@fundon (5)
@evolvedlight (5)
@nicolai86 (5)
@chadoe (5)
@andmarios (5)
@exmex (5)
@barracks510 (5)
@ogarcia (4)
@chk1 (4)
@rokuu (4)
@kakwa (4)
@tboerger (4)
@DblK (4)
@roblabla (4)
@psaavedra (4)
@michaelboke (4)
@llikeitt (4)
@denghongcai (4)
@eryx (4)
@ciarand (4)
@achilleas-k (4)
@moltam (3)
@Preovaleo (3)
@crackcomm (3)
@eightpigs (3)
@imgbot[bot] (3)
@leonklingele (3)
@m2nlight (3)
@zhsso (3)
@comminux (3)
@tonivj5 (3)
@richmahn (3)
@pbor (3)
@ndarilek (3)
@jxshin (3)
@thehowl (3)
@djcas9 (3)
@diseaz (3)
@arthuroy (3)
@hochhaus (3)
@aaronjwood (3)
@Supme (3)
@aboron (2)
@alpencrossi (2)
@atzoum (2)
@Dennis-Smurf (2)
@dlob (2)
@euank (2)
@norajam (2)
@Boc-chi-no (2)
@billiegoose (2)
Recent Commits
web: use flamego's built-in plaintext recovery (#8402)
ifer47(19 Jul 26)
docker: stop generating DSA host keys (#8366) Co-authored-by: yangkangkang <[email protected]>
security: fix argument injection via crafted references on repository API endpoints (#8393)
security: harden same-site redirect validation (#8391)
security: fix argument injection via crafted branch names in pull requests (#8390)
Arpit Jain(15 Jul 26)
tool: avoid panic in BasicAuthDecode on a value with no colon (#8387) Signed-off-by: Arpit Jain <[email protected]>
conf: resolve session and TLS cert paths against work directory (#8386)
chore(deps): bump golang.org/x/net from 0.54.0 to 0.55.0 (#8378) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
chore: mark portless be interactive in moon [skip ci]
Duy P(12 Jul 26)
web: fix frontend assets behind reverse-proxy subpaths (#8384)
chore(deps): bump golang.org/x/crypto from 0.49.0 to 0.52.0 (#8381) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
chore: remove ineffective CODEOWNERS at root [skip ci]
chore(deps-dev): bump vite from 8.0.13 to 8.0.16 (#8367) Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
web: remove the install page (#8350)
web: use a single landing banner for light and dark mode (#8344)
chore: update SHA256 checksum link in release issue templates (#8345) [skip ci]
fix: surface 5xx errors in the SPA boot and route loaders (#8343)
release: cut CHANGELOG entries for 0.14.3 (#8338) [skip ci]
chore: update CHANGELOG for removed custom templates [skip ci]
security: require token auth for org metadata and team list (#8336)
security: time out stalled SSH handshakes after 15s (#8335)
security: reject path traversal in owner and repository names (#8334)
security: verify content hash on LFS dedupe shortcut (#8333)
security: walk full upload path for symlinks (#8332)
security: harden Git HTTP access checks (#8331)
security: upgrade notebookjs and route ipynb HTML through DOMPurify (#8330)
security: enforce RESET_PASSWORD_CODE_LIVES on reset tokens (#8328)
security: require admin for repo settings API endpoints (#8327)
security: restrict ipynb sanitizer to safe image data URIs (#8326)
security: sanitize milestone names in new issue form (#8325)
Gogs Security
Security Advisories (65)
- mediumPatchedCVSS 4.3
CVE-2026-52795Authorization Bypass in Watch API allows any user to monitor private repository activity
- lowPatched
CVE-2026-52815Unauthenticated Organization Teams Information Disclosure via API
- mediumPatched
CVE-2026-52814Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Descriptor Exhaustion)
- criticalPatchedCVSS 10
CVE-2026-52813Path Traversal in organization name results in RCE through Git hooks
- highPatched
CVE-2026-52812LFS dedupe path leaks private repo content across tenants
- criticalPatched
CVE-2026-52811UploadRepoFiles writes outside repo working tree via committed parent sym
- highPatched
CVE-2026-52810Write to readonly repositories using receive-pack + service=git-upload-pack confusion
- highPatched
GHSA-6vxv-wg6j-5qwpXSS in .ipynb files renderer due to outdated notebookjs
- lowPatched
CVE-2026-52809Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
- mediumPatched
CVE-2026-52808Write-level collaborators can mutate admin-only repository settings via API
- highPatched
CVE-2026-52816Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS
- highPatched
CVE-2026-52807DOM-based XSS via Milestone Name on New Issue Page
- criticalPatchedCVSS 9.9
CVE-2026-52806RCE via git rebase --exec argument injection in pull request merge
- highPatchedCVSS 8.7
CVE-2026-52805Migration Redirect Bypass Leads to Internal Repository Theft
- highPatched
CVE-2026-52804Privilege Escalation via Collaboration Access Mode Validation
- mediumPatchedCVSS 5.4
CVE-2026-52802Open Redirect via redirect_to
- highPatchedCVSS 8.1
CVE-2026-52801Ability to import local repositories via Mirror Settings
- highPatchedCVSS 8.8
CVE-2026-52800CSRF Leading to Organization Owner Takeover
- highPatchedCVSS 7.5
CVE-2026-52799Missing Authorization in Attachment Download
- highPatchedCVSS 8.9
CVE-2026-52798Stored XSS in `.ipynb` Preview
- highPatchedCVSS 7.3
CVE-2026-26276DOM-based XSS via milestone selection
- mediumPatched
CVE-2026-26196Access tokens get exposed through URL params in API requests
- mediumPatched
CVE-2026-26195Stored XSS in branch and wiki views through author and committer names
- highPatched
CVE-2026-26194Release tag option injection in release deletion
- highPatchedCVSS 8.7
CVE-2026-26022Stored XSS via data URI in issue comments
- mediumPatched
CVE-2026-25229Authorization bypass allows cross-repository label modification
- mediumPatched
CVE-2026-25119Authentication Bypass via Unvalidated Reverse Proxy Headers
- mediumPatched
CVE-2026-25120Cross-repository comment deletion
- mediumPatchedCVSS 6.5
CVE-2026-23633Arbitrary file read/write via path traversal in Git hook editing
- mediumPatchedCVSS 6.5
CVE-2026-23632Update repository content via API with read-only permission
- highPatched
CVE-2026-24135Arbitrary file deletion via path traversal in wiki page update
- mediumPatchedCVSS 6.5
CVE-2026-22592DoS in repository mirror sync
- criticalPatched
CVE-2026-25232Protected branch bypass in web UI
- mediumPatched
CVE-2025-65852Authorization bypass in repository deletion API
- highPatchedCVSS 7.3
GHSA-26gq-grmh-6xm6Stored XSS via Mermaid diagrams
- mediumPatchedCVSS 4.9
CVE-2025-64719DoS in repository/wiki file listing pages
- mediumPatched
CVE-2026-25242Unauthenticated file upload
- highPatched
CVE-2025-641752FA bypass via recovery code
- criticalPatched
CVE-2025-64111RCE in repository put contents API
- mediumPatched
CVE-2026-47267SSRF in webhook deliveries
- criticalPatchedCVSS 10
CVE-2024-56731Deletion of internal files allows remote command execution
- highPatchedCVSS 7.7
CVE-2024-39933Argument Injection when tagging new releases
- criticalPatchedCVSS 9.9
CVE-2024-39932Argument Injection during changes preview
- criticalPatchedCVSS 9.9
CVE-2024-39931Deletion of internal files
- criticalPatchedCVSS 9.9
CVE-2024-39930Argument Injection in the built-in SSH server
- criticalPatched
CVE-2024-55947Path Traversal in file update API
- criticalPatched
CVE-2024-54148Path Traversal in file editing UI
- criticalPatchedCVSS 9.3
CVE-2026-25921 Cross-repository LFS object overwrite via missing content hash verification
- mediumPatchedCVSS 6.3
CVE-2025-47943Stored XSS in PDF renderer
- highPatchedCVSS 8.5
CVE-2026-52797Overwriting critical files results in a denial of service
- lowPatchedCVSS 3.5
CVE-2026-52796DoS in rendering issue index pattern
- criticalPatched
CVE-2022-2024OS Command Injection in repo editor on case-insensitive file systems
- criticalPatched
CVE-2022-32174Stored XSS Assignee
- highPatched
CVE-2022-1993Path Traversal in Git HTTP endpoints
- criticalPatched
CVE-2022-1992Path Traversal in file editor on Windows
- mediumPatched
CVE-2022-31038XSS vulnerability in repository issue list
- criticalPatched
CVE-2022-1986OS Command Injection in file editor
- criticalPatched
CVE-2021-32546Remote Command Execution in file editing
- criticalPatched
CVE-2022-1884OS Command Injection in file uploading
- lowPatched
GHSA-pj96-4jhv-v792XSS in cookies
- highPatched
CVE-2022-1285SSRF in webhook
- mediumPatched
CVE-2022-1464Stored XSS in issues
- criticalPatched
CVE-2022-0415Remote command execution in file uploading
- mediumPatched
CVE-2022-0870SSRF in repository migration
- mediumPatched
CVE-2022-0871Improper PAM authorization handling
Gogs Website
Website
Introduction - Gogs: A painless self-hosted Git service
The painless way to host your own Git service
Redirects
Redirects to https://gogs.io/getting-started/introduction
Security Checks
All 65 security checks passed
Server Details
- IP Address162.159.143.13
- LocationSan Francisco,California,United States of America,NA
- ISPCloudFlare Inc.
- ASNAS13335
Associated Countries
US
Safety Score
Website marked as safe
100%
Blacklist Check
gogs.io was found on 0 blacklists
- AntiSocial Blacklist
- Artists Against 419
- Badbitcoin
- Bambenek Consulting
- CERT Polska
- CoinBlockerLists
- CRDF
- CryptoScamDB
- EtherAddressLookup
- EtherScamDB
- Fake Website Buster
- MetaMask EthPhishing
- NABP Not Recommended Sites
- OpenPhish
- PetScams
- PhishFeed
- PhishFort
- Phishing.Database
- PhishStats
- PhishTank
- Phishunt
- RPiList Not Serious
- Scam.Directory
- SecureReload Phishing List
- Spam404
- StopGunScams
- Suspicious Hosting IP
- ThreatFox
- ThreatLog
- TweetFeed
- URLhaus
- ViriBack C2 Tracker
Website Preview
Gogs Reviews
More Code Hosting
A fully-managed instance of Forgejo.
Lightweight self-hosted git platform, written in Go.
Fully-featured git, CI and project management platform. Managed instance available, but can also be self-hosted.
Git and mercurial code hosting, task management, mailing lists, wiki hosting and Alpine-based build pipelines. Can be self-hosted, or used through the managed instance at sr.ht.
About the Data: Gogs
Change History
- Amended (github) #608
Edit Gogs Data
You can edit Gogs's entry in this section of awesome-privacy.yml by submitting a PR to our GitHub repo.
Note that some of the information shown above has been aggregated from external
sources, a list of these can be found data documentation.
Origin Data
Modify Data
API
You can access Gogs's data programmatically via our API. Simply make a GET request to:
https://api.awesome-privacy.xyz/v1/services/gogsThe REST API is free, no-auth and CORS-enabled. To learn more, view the API Docs or read the API Usage Guide.
Share Gogs
Help your friends compare Code Hosting, and pick privacy-respecting software and services.
Share Gogs and Awesome Privacy with your network!