CVE-2024-55947CWE-22
Gogs has a Path Traversal in file update API
High · published December 23, 2024
Patch now
High probability of exploitation
CVSS calls it high at 8.7. It sits in the 99.6th percentile for exploit probability.
What it is
Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.
The record
Technical detail
- CVSS v4.0
- 8.7 · HIGH
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
- EPSS
- 0.77836 · 99.6th percentile
- Weakness
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Published
- 2024-12-23T15:26Z
EPSS history
Timeline