CVE-2022-1993

This vulnerability is like an “addressing mistake” in Gogs that lets someone use a specially crafted path to reach outside the normal storage area. If they have basic access, they may be able to peek at sensitive files or change files they shouldn’t. The impact can include leaking secrets (like configuration) or causing problems by tampering with server files.

This matters if you run Gogs (gogs/gogs or gogs.io/gogs) and you are on a version prior to 0.12.9. The risk is for attackers who already have valid low-level privileges, using the network (no special user clicking is required). Only pursue this urgently if your Gogs is reachable from an attacker’s network and there is any chance of an attacker obtaining those low-level credentials.

This is an Amber issue because there is a public exploit and the flaw directly enables reading or writing restricted files once an attacker has low-level access. While it requires valid access, path traversal often turns that access into broader server impact, including potential secret exposure. Prioritize patching now to close the file access gap.

1. Confirm exposure

   • Identify the exact Gogs deployment and the installed version.
   • Determine whether the version is prior to 0.12.9.
   • Check whether your users include any accounts with low-level privileges (for example, accounts that can perform file/path-related actions in Git or repository features).

2. Validate reachability and exposure window

   • Confirm how Gogs is exposed (public internet vs. internal network).
   • If it is internet-reachable, treat this as higher risk because the attack path is network-based.

3. Upgrade remediation (target fix)

   • Upgrade Gogs to 0.12.9 or later.
   • The fixed versions are:
     • gogs/gogs: fixed in 0.12.9
     • gogs.io/gogs: fixed in 0.12.9

4. If you cannot upgrade immediately (workaround guidance)

   • Reduce who can authenticate to Gogs (disable unused accounts, enforce strong access control for low-privilege users).
   • Restrict network access so only trusted networks/users can reach Gogs (e.g., allowlist IPs / restrict to VPN or internal network), since the attack vector is network-based.

5. After upgrade: monitor for follow-up indicators

   • Review application and server logs for unusual file access patterns, path-like strings, repeated errors around file operations, or unexpected write activity.
   • If you suspect abuse, preserve logs and consider rotating any secrets that may have been accessible (based on what’s stored in the restricted directories).

CVE-2022-1993 is a path traversal vulnerability (CWE-22) in gogs/gogs before 0.12.9. The mechanism is insufficient path handling: an authenticated user with low-level privileges can manipulate file paths to access files outside the intended application directory. The network attack vector and “no user interaction” align with direct requests from a remote attacker once they have valid account access.

Exploitation status: a public exploit is available, and this is reflected in the traffic-light verdict (Amber). KEV is not listed in CISA KEV. EPSS was predicted (trend: rising), but public exploitation and the vulnerability capability itself are what drive urgency in practice.

Fix: upgrade to 0.12.9 (fixed in 0.12.9 across the reported gogs/gogs variants).