GitHub Advisoryadvisory · Go

GHSA-phm4-wf3h-pc3r Remote Code Execution in Gogs

HIGH Published 2024-11-15 Modified 2025-10-08 Official page ↗
Aliases
CVE-2024-44625
Ecosystem
Go
Packages
gogs.io/gogs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-22
Reviewed
2024-11-15

Affected packages

• Go gogs.io/gogs: < 0.13.2 → fixed in 0.13.2

Description

Gogs <0.13.2 is vulnerable to symbolic link path traversal that enables remote code execution via the editFilePost function of internal/route/repo/editor.go.

Related

Alias · CVE (1)

  • CVE-2024-44625 Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go. vulnerability

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References