CVE-2024-55947: high-severity vulnerability in gogs
Gogs has a Path Traversal in file update API
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Gogs has a flaw that lets an attacker write files anywhere on the server through its file update API, which can be used to gain unauthorized SSH access to the system.
A path traversal vulnerability in Gogs' file update API (CWE-22) allows an authenticated or unauthenticated attacker to write arbitrary files to any location on the filesystem, enabling SSH key injection for remote code execution. The vulnerability requires access to the file update endpoint and is mitigated in version 0.13.1 and later.
In the same product, most dangerous first.