---
id: CVE-2021-32546
aliases:
  - GHSA-56j7-2pm8-rgmx
  - GO-2022-0471
title: OS Command Injection in gogs
summary: OS Command Injection in gogs
severity: critical
vendor: gogs
product: gogs.io/gogs
ecosystem: go
affected:
  - gogs.io/gogs < 0.12.8
patched:
  - gogs.io/gogs 0.12.8
published: '2022-06-02'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-56j7-2pm8-rgmx'
references:
  - url: 'https://github.com/gogs/gogs/security/advisories/GHSA-56j7-2pm8-rgmx'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-32546'
  - url: 'https://github.com/gogs/gogs/issues/6555'
  - url: 'https://github.com/gogs/gogs/pull/6986'
  - url: 'https://github.com/gogs/gogs'
  - url: >-
      https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129
  - url: 'https://github.com/gogs/gogs/releases'
  - url: 'https://github.com/gogs/gogs/releases/tag/v0.12.8'
tags:
  - osv
  - go
epss: 0.02068
epssPercentile: 0.80571
ingestedAt: '2026-07-09T18:56:35.915Z'
---

## Overview

### Impact

The malicious user is able to update a crafted `config` file into repository's `.git` directory with to gain SSH access to the server. All installations with [repository upload enabled (default)](https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129) are affected.

### Patches

Repository file updates are prohibited to its `.git` directory. Users should upgrade to 0.12.8 or the latest 0.13.0+dev.

### Workarounds

N/A

### References

N/A

### For more information

If you have any questions or comments about this advisory, please post on #6555.


## Affected packages

- `gogs.io/gogs < 0.12.8`

## Remediation

Upgrade to a patched release:

- `gogs.io/gogs 0.12.8`