CVE-2020-15867 - CVE House
Back to Database
Status published High CVE-2020-15867

The git hook feature in Gogs 0.5.5 through 0.12.2 allows...

Vulnerability Description

The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. There can be a privilege escalation if access to this hook feature is granted to a user who does not have administrative privileges. NOTE: because this is mentioned in the documentation but not in the UI, it could be considered a "Product UI does not Warn User of Unsafe Actions" issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-15867

Credits & Attribution

No credits recorded in the NVD database.

References

More from gogs

View All →
CVE-2025-64719
Gogs: Denial of Service in repository/wiki file listing web pages
Medium 4.9
CVE-2025-64175
Gogs Vulnerable to 2FA Bypass via Recovery Code
High 7.7
CVE-2025-64111
Gogs's update .git/config file allows remote command execution
Critical 9.3
CVE-2025-47943
Gogs stored XSS in PDF renderer
Medium 6.3
CVE-2024-56731
Gogs deletion of internal files allows remote command execution
Critical 10

Affected Vendor

Affected Software

gogs
Vulnerable Versions:
0.5.5

Timeline

Official Publish: October 16th, 2020
Last Modified: August 4th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.