PT-2024-10015 · Gogs · Gogs

Published 2024-08-10 · Updated 2025-01-03 · CVE-2024-44625

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Gogs versions <=0.13.0

Description The issue is related to a Directory Traversal vulnerability via the editFilePost function in the internal/route/repo/editor.go file. This vulnerability is caused by improper restriction of the directory path name, allowing a remote attacker to execute arbitrary code.

Recommendations For Gogs versions <=0.13.0, as a temporary workaround, consider disabling the editFilePost function until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2025-00143

CVE-2024-44625

GHSA-PHM4-WF3H-PC3R

GO-2024-3275

OPENSUSE-SU-2024:14513-1

Affected Products

Gogs

References · 29

• 🔥 https://github.com/Fysac/CVE-2024-44625/blob/main/poc.py · Exploit
• 🔥 https://github.com/Fysac/CVE-2024-44625 · Exploit
• 🔥 https://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs · Exploit
• https://osv.dev/vulnerability/GHSA-phm4-wf3h-pc3r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-44625 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:14513-1 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2024-3275 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-00143 · Security Note
• https://osv.dev/vulnerability/CVE-2024-44625 · Vendor Advisory
• https://github.com/gogs/gogs · Note
• https://github.com/gogs/gogs/issues/7777 · Note
• https://suse.com/security/cve/CVE-2024-9526 · Note
• https://suse.com/security/cve/CVE-2024-52308 · Note
• https://suse.com/security/cve/CVE-2024-24425 · Note
• https://t.me/cybersecuritytechnologies/11640 · Telegram Post