CVE-2018-18925

Published: 2018-11-04T05:29Z

Last Modified: 2024-11-21T03:56Z

Source: MITRE CVE List

License: MITRE-CVE-TOS

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron. > MITRE Terms of Use apply – see LICENSE‑MITRE.txt