Executive brief
Gogs XSS allowed by stored call in PDF renderer in gogs.io/gogs
Affected products
- Go github.com/gogs/gogs
- Go gogs.io/gogs
Junglewise Threat Intelligence
CVE-2025-47943: GO-2025-3778 - Gogs XSS allowed by stored call in PDF renderer in gogs.io/gogs
CVE-2025-47943 · Severity: low · CVSS 3.1 · Published 2025-07-28
Technologies: github.com/gogs/gogs (Go), gogs.io/gogs (Go). Vendors: Go.
Related threats
- GO-2026-5193 - Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs
- Gogs stored XSS in Jupyter Notebook sanitizer endpoint
- Gogs unauthenticated information disclosure in organization teams API
- Gogs Denial of Service via SSH handshake stall in built-in SSH server
- Gogs path traversal and RCE via organization names