CVE-2024-55947 HIGH

CVE-2024-55947: Gogs has a Path Traversal in file update API

Vendor Gogs

Product gogs

Weakness CWE-22 · Path traversal

Published December 23, 2024

Last update December 24, 2024

View on NVD All CVEs

CVSS base score

8.7/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

Key dates

02Disclosure timeline

December 23, 2024 CVE published

December 24, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-55947 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/22.html