CVE-2024-56731: critical vulnerability in gogs
Gogs deletion of internal files allows remote command execution
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Gogs allows unprivileged users to delete critical internal Git files and run arbitrary commands on the server. An attacker can take control of the Gogs instance and access or modify any code stored there.
CWE-552 (Files or Directories Accessible to External Parties) allows unauthenticated or low-privilege users to delete files in the .git directory through an incomplete patch, enabling arbitrary command execution with RUN_USER privileges. The vulnerability affects Gogs versions prior to 0.13.3 and can be exploited to compromise all repositories on the instance.
In the same product, most dangerous first.