CVE-2024-55947: Path Traversal in file update API in gogs

December 23, 2024 (updated April 10, 2025)

The malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server.

References

github.com/advisories/GHSA-qf5v-rp47-55gg
github.com/gogs/gogs
github.com/gogs/gogs/commit/9a9388ace25bd646f5098cb9193d983332c34e41
github.com/gogs/gogs/issues/7582
github.com/gogs/gogs/pull/7859
github.com/gogs/gogs/security/advisories/GHSA-qf5v-rp47-55gg
nvd.nist.gov/vuln/detail/CVE-2024-55947

Code Behaviors & Features

Detect and mitigate CVE-2024-55947 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →