CVE-2026-24135: high-severity vulnerability in gogs
Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Gogs allows authenticated users with wiki write access to delete arbitrary files on the server by manipulating file paths in wiki page updates. This can lead to critical system damage or data loss.
A path traversal vulnerability in the updateWikiPage function allows authenticated attackers with repository wiki write permissions to delete arbitrary files by exploiting the old_title parameter. The vulnerability requires valid repository access but enables unrestricted file deletion through directory traversal techniques, affecting system integrity and availability.
In the same product, most dangerous first.