CVSS 4.0
8.8 highCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:NCVE-2026-26194
High (8.8) in gogs gogs. EPSS 0.5% chance of exploitation in the next 30 days. Fixed in gogs.io/gogs 0.14.2.
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, there's a security issue in gogs where deleting a release can fail if a user controlled tag name is passed to git without the right separator, this lets git options get injected and mess with the process. This issue has been patched in version 0.14.2.
Severity
CVSS 3.1
7.3 highCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
- CWE
- CWE-88
- Published
- Modified
- Record from
- the NVD, synced
Affected
- gogs:gogs
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-v9vm-r24h-6rqm | Go | gogs.io/gogs | <0.14.2 | 0.14.2 |
| GO-2026-4617 | Go | gogs.io/gogs | all versions | no fix published |