Vulnerability advisory
GHSA-ccqv-43vm-4f3w
Gogs allows deletion of internal files
Also known as CVE-2024-39931GHSA-2vgj-3pvg-xh4wGO-2024-2970
Severity
- CVSS 3.x
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N
Affected versions
| Affected | Fixed in |
|---|---|
| All versions before 0.13.1 | 0.13.1 |
Description
Impact
Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.
Patches
Deletion of .git files has been prohibited (https://github.com/gogs/gogs/pull/7870). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.
Workarounds
No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.