CVE-2025-47943: Gogs stored XSS in PDF renderer
Summary
A stored XSS is present in Gogs which allows client-side Javascript code execution.
Details
Gogs Version: docker images REPOSITORY TAG IMAGE ID CREATED SIZE gogs/gogs latest fe92583bc4fe 10 hours ago 99.3MB
Application version: 0.14.0+dev
Local setup using: bash Pull image from Docker Hub. docker pull gogs/gogs
Create local directory for volume. sudo mkdir -p /var/gogs
Use docker run for the first time. docker run --name=gogs -p 10022:22 -p 10880:3000 -v /var/gogs:/data gogs/gogs
The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/. Read more about this vulnerability at codeanlabs - CVE-2024-4367.
PoC
1. Upload the Proof of Concept file hosted at https://codeanlabs.com/wp-content/uploads/2024/05/pocgeneralizedCVE-2024-4367.pdf in a repository. 2. Click on the file to be previewed.
!poc
Credits
Edoardo Ottavianelli
Other sources
Gogs is an open source self-hosted Git service. In application version 0.14.0+dev and prior, there is a stored cross-site scripting (XSS) vulnerability present in Gogs, which allows client-side Javascript code execution. The vulnerability is caused by the usage of a vulnerable and outdated component: pdfjs-1.4.20 under public/plugins/. This issue has been fixed for gogs.io/gogs in version 0.13.3.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47943?
CVE-2025-47943 is a stored cross-site scripting (XSS) vulnerability that allows for client-side Javascript code execution.
How do I fix CVE-2025-47943?
To fix CVE-2025-47943, upgrade Gogs to version 0.14.0 or later.
Which versions of Gogs are affected by CVE-2025-47943?
Gogs versions from 0.13.3 up to, but not including, 0.14.0+dev are affected by CVE-2025-47943.
What impact does CVE-2025-47943 have on my Gogs installation?
CVE-2025-47943 can allow attackers to execute arbitrary client-side scripts in the context of the user’s session.
Is there a workaround for CVE-2025-47943 if I cannot upgrade Gogs?
There are no documented workarounds for CVE-2025-47943; upgrading to a patched version is recommended.