CVE-2024-54148: Remote Command Execution in file editing in gogs

December 23, 2024 (updated April 10, 2025)

The malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server.

References

github.com/advisories/GHSA-r7j8-5h9c-f6fx
github.com/gogs/gogs
github.com/gogs/gogs/commit/c94baec9ca923f38c19f0c7c5af722b9ec04022a
github.com/gogs/gogs/issues/7582
github.com/gogs/gogs/pull/7857
github.com/gogs/gogs/security/advisories/GHSA-r7j8-5h9c-f6fx
nvd.nist.gov/vuln/detail/CVE-2024-54148

Code Behaviors & Features

Detect and mitigate CVE-2024-54148 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →