CVE-2026-26194

Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen oder vertrauliche Informationen offenzulegen.

Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen – sogar mit erweiterten Berechtigungen, was zur vollständigen Kontrolle über das System führen kann –, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten oder einen Denial-of-Service-Zustand zu verursachen.

### Summary There is a security issue in Gogs where deleting a release can fail if a user-controlled tag name is passed to Git without the right separator, allowing Git option injection and therefore interfering with the process. ### Affected Component - internal/database/release.go `process.ExecDir(..., "git", "tag", "-d", rel.TagName)` ### Details `rel.TagName` is used as a CLI argument to `git tag -d` without `--` or `--end-of-options`. If the tag name begins with `-`, Git parses it as a flag. The prior mitigation is incomplete. There is path sanitization in place during creation: - internal/database/release.go `r.TagName = strings.TrimLeft(r.TagName, "-")` But it only covers one creation path and does not reliably protect tag deletions, such as tags added through `git push` or ref updates. **Exploit Conditions** 1. An attacker can add a tag name that starts with a dash into the repository. 2. A user with permission to delete releases triggers it through the web UI or API. ### Recommended Fix 1. Add end-of-options in release deletion: - `git tag -d -- <tagName>` 2. It is better to use the safe git-module deletion helper since it handles options properly. 3. All Git commands should be audited for user input, ensuring that the end-of-options separator is always used. ### Impact - Option injection into `git tag -d` - Tag/release deletion can fail or behave unexpectedly - Operational denial of service in release cleanup workflows - Potential release metadata inconsistency

Gogs: Release tag option injection in release deletion in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: gogs.io/gogs before v0.14.2.