CRITICAL 9.1 Go
Path Traversal in file editor on Windows in Gogs
GHSA-994f-7g86-qr56 · CVE-2022-1992 · GO-2022-0570
Published · Modified
Description
Impact
The malicious user is able to delete and upload arbitrary file(s). All installations on Windows with repository upload enabled (default) are affected.
Patches
Path cleaning has accommodated for Windows. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.
Workarounds
N/A
References
https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab/
For more information
If you have any questions or comments about this advisory, please post on #7001.
References
- WEB https://github.com/gogs/gogs/security/advisories/GHSA-994f-7g86-qr56
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2022-1992
- WEB https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0
- PACKAGE https://github.com/gogs/gogs
- WEB https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129
- WEB https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab
Ready to move
Start Securing
Free, no credit card | First findings in minutes