Cross-site scripting in gogs - CVE-2025-47943
Published: April 27, 2026
Vulnerability identifier: #VU128079
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
CVE-ID: CVE-2025-47943
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute arbitrary javascript code in the victim's browser.
The vulnerability exists due to cross-site scripting in the PDF renderer using pdfjs-1.4.20 when previewing an uploaded PDF file. A remote user can upload a specially crafted PDF file to execute arbitrary javascript code in the victim's browser.
User interaction is required to click on the uploaded file for preview.
Affected software
gogs
How to mitigate CVE-2025-47943
Install security update from vendor's website.
gogs - update to 0.13.3