Remote Code Execution in Gogs

GHSA-phm4-wf3h-pc3r · CVE-2024-44625 · GO-2024-3275

Published Nov 15, 2024 · Modified Oct 8, 2025

Description

Gogs <0.13.2 is vulnerable to symbolic link path traversal that enables remote code execution via the editFilePost function of internal/route/repo/editor.go.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-44625
WEB https://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs
PACKAGE https://github.com/gogs/gogs
WEB https://gogs.io
WEB https://pkg.go.dev/vuln/GO-2024-3275

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes