CVE-2024-44625

HIGH8.8EPSS 81.8%

Remote Code Execution in Gogs

Published: 11/15/2024Modified: 10/8/2025

Also known as:GHSA-phm4-wf3h-pc3rGO-2024-3275

Description

Gogs <0.13.2 is vulnerable to symbolic link path traversal that enables remote code execution via the editFilePost function of internal/route/repo/editor.go.

Affected packages (2)

Go/gogs.io/gogsfrom 0, < 0.13.2
Go/gogs.io/gogsfrom 0

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	HIGH8.8	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References (6)

ADVISORYhttps://github.com/advisories/GHSA-phm4-wf3h-pc3r
ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2024-44625
PATCHhttps://github.com/gogs/gogs
WEBhttps://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs
WEBhttps://gogs.io
WEBhttps://pkg.go.dev/vuln/GO-2024-3275