Gogs has a Path Traversal in file editing UI

Gogs allows attackers to exploit symlink files in repositories to gain unauthorized SSH access to the server. By committing and editing specially crafted symlink files, a malicious user can bypass access controls and compromise the system.

This path traversal vulnerability (CWE-22, CWE-61) in Gogs' file editing UI permits authenticated users to commit symlink files that traverse directories outside the repository scope. The flaw enables attackers to manipulate SSH access mechanisms, potentially leading to remote code execution or unauthorized system access. Exploitation requires repository write access.