CVE-2024-54148: high-severity vulnerability in gogs
Gogs has a Path Traversal in file editing UI
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Gogs allows attackers to exploit symlink files in repositories to gain unauthorized SSH access to the server. By committing and editing specially crafted symlink files, a malicious user can bypass access controls and compromise the system.
This path traversal vulnerability (CWE-22, CWE-61) in Gogs' file editing UI permits authenticated users to commit symlink files that traverse directories outside the repository scope. The flaw enables attackers to manipulate SSH access mechanisms, potentially leading to remote code execution or unauthorized system access. Exploitation requires repository write access.
In the same product, most dangerous first.