CVE-2021-32546 - CVE House
Back to Database
Status published High CVE-2021-32546

Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows...

Vulnerability Description

Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker (registered user) can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that configuration can contain an option such as sshCommand, which is executed when a master branch is a remote branch (using an ssh:// URI). The remote branch can also be configured by editing the Git configuration file. One can create a new file in a new repository, using the GUI, with "\" as its name, and then rename this file to .git/config with the custom configuration content (and then save it).

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2021-32546

Credits & Attribution

No credits recorded in the NVD database.

References

More from gogs

View All →
CVE-2025-64719
Gogs: Denial of Service in repository/wiki file listing web pages
Medium 4.9
CVE-2025-64175
Gogs Vulnerable to 2FA Bypass via Recovery Code
High 7.7
CVE-2025-64111
Gogs's update .git/config file allows remote command execution
Critical 9.3
CVE-2025-47943
Gogs stored XSS in PDF renderer
Medium 6.3
CVE-2024-56731
Gogs deletion of internal files allows remote command execution
Critical 10

Affected Vendor

Affected Software

gogs
Vulnerable Versions:
0

Timeline

Official Publish: May 31st, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.