CVE-2024-39931 — Vulnerability in gogs.io/gogs — CVE Details

CRITICAL

Gogs allows deletion of internal files

Published December 23, 2024Updated December 23, 2024Source: osv

Summary

### Impact Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by `RUN_USER` in the configuration. It allows attackers to access and alter any users' code hosted on the same instance. ### Patches Deletion of `.git` files has been prohibited (https://github.com/gogs/gogs/pull/7870). Users should upgrade to 0.13.1 or the latest 0.14.0+dev. ### Workarounds No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions. ### References https://www.cve.org/CVERecord?id=CVE-2024-39931

Advisory Timeline

First published December 23, 2024 (658 days ago).
Last revised December 23, 2024 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update gogs.io/gogs to 0.13.1 or later

go get gogs.io/gogs@v0.13.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

Package	Ecosystem	Affected	Fixed In
gogs.io/gogs	go	All versions	0.13.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-552
View on MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

References

Frequently Asked Questions

What is CVE-2024-39931?: Gogs allows deletion of internal files This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2024-39931?: CVE-2024-39931 affects gogs.io/gogs. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-39931 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-ccqv-43vm-4f3w

GHSA-2vgj-3pvg-xh4w

GO-2024-2970

Related CVEs

CVE-2022-1986
CRITICAL
OS Command Injection in file editor in Gogs
CVE-2026-52811
CRITICAL
Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym
CVE-2026-52806
CRITICAL
Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge
CVE-2024-39930
CRITICAL
Gogs has an argument Injection in the built-in SSH server
CVE-2024-56731
CRITICAL
Gogs allows deletion of internal files which leads to remote command execution
CVE-2024-54148
HIGH
Remote Command Execution in file editing in gogs
CVE-2026-26022
HIGH
Gogs: Stored XSS via data URI in issue comments
CVE-2026-52816
MEDIUM
Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies