Stored xss bug in gogs/gogs
Apr 12th 2022
stored xss bug
Proof of Concept
create a public repo and create a issue .
now in issue upload a html file with xss payload inside.
When any user view the repo and click the attachment link then xss is executed .
you can upload https://github.com/ranjit-git/poc/edit/master/evilsvgfile.svg this file also
The patch has landed in https://github.com/gogs/gogs/commit/cb35b73048b91ca32ee89d5b05a09552db8e5faf, but we will only "Mark as fixed" until a new release is published according to security policy (https://github.com/gogs/gogs/blob/main/SECURITY.md).
The patch has been published, thanks again for finding this vulnerability!