Path Traversal in GitHub repository gogs/gogs prior to 0.12.9.
In plain language
Written by AI from the record
If you run Gogs version prior to 0.12.9, an attacker who has basic access can trick it into reading or writing files outside its normal folders—so you should patch.
CVE-2022-1993 is a path traversal issue in gogs/gogs before 0.12.9 that allows an authenticated user with low-level privileges to manipulate file paths and read/write files outside the intended application directory over the network.
If you're affected
Sensitive file exposure
Unauthorized file modification
Service disruption risk
Credential/secret leakage
What is it
This vulnerability is like an “addressing mistake” in Gogs that lets someone use a specially crafted path to reach outside the normal storage area. If they have basic access, they may be able to peek at sensitive files or change files they shouldn’t. The impact can include leaking secrets (like configuration) or causing problems by tampering with server files.
Who is affected
This matters if you run Gogs (gogs/gogs or gogs.io/gogs) and you are on a version prior to 0.12.9. The risk is for attackers who already have valid low-level privileges, using the network (no special user clicking is required). Only pursue this urgently if your Gogs is reachable from an attacker’s network and there is any chance of an attacker obtaining those low-level credentials.
How urgent is it
This is an Amber issue because there is a public exploit and the flaw directly enables reading or writing restricted files once an attacker has low-level access. While it requires valid access, path traversal often turns that access into broader server impact, including potential secret exposure. Prioritize patching now to close the file access gap.
What to do — in detail
Confirm exposure
Identify the exact Gogs deployment and the installed version.
Determine whether the version is prior to 0.12.9.
Check whether your users include any accounts with low-level privileges (for example, accounts that can perform file/path-related actions in Git or repository features).
Validate reachability and exposure window
Confirm how Gogs is exposed (public internet vs. internal network).
If it is internet-reachable, treat this as higher risk because the attack path is network-based.
Upgrade remediation (target fix)
Upgrade Gogs to 0.12.9 or later.
The fixed versions are:
gogs/gogs: fixed in 0.12.9
gogs.io/gogs: fixed in 0.12.9
If you cannot upgrade immediately (workaround guidance)
Reduce who can authenticate to Gogs (disable unused accounts, enforce strong access control for low-privilege users).
Restrict network access so only trusted networks/users can reach Gogs (e.g., allowlist IPs / restrict to VPN or internal network), since the attack vector is network-based.
After upgrade: monitor for follow-up indicators
Review application and server logs for unusual file access patterns, path-like strings, repeated errors around file operations, or unexpected write activity.
If you suspect abuse, preserve logs and consider rotating any secrets that may have been accessible (based on what’s stored in the restricted directories).
Technical context
CVE-2022-1993 is a path traversal vulnerability (CWE-22) in gogs/gogs before 0.12.9. The mechanism is insufficient path handling: an authenticated user with low-level privileges can manipulate file paths to access files outside the intended application directory. The network attack vector and “no user interaction” align with direct requests from a remote attacker once they have valid account access.
Exploitation status: a public exploit is available, and this is reflected in the traffic-light verdict (Amber). KEV is not listed in CISA KEV. EPSS was predicted (trend: rising), but public exploitation and the vulnerability capability itself are what drive urgency in practice.
Fix: upgrade to 0.12.9 (fixed in 0.12.9 across the reported gogs/gogs variants).
This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.
