CVE-2018-18925 | BDVDB-2026-109079 Detail

Description#

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/gogs/gogs/issues/5469

Exploit#

No public exploit known

History#

Version 12018-11-04Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.