CVE-2024-39932 — Vulnerability in gogs.io/gogs — CVE Details

CRITICAL

Gogs allows argument injection during the previewing of changes

Published December 23, 2024Updated December 23, 2024Source: osv

Summary

### Impact Unprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user's code hosted on the same instance. ### Patches Unintended Git options has been ignored for diff preview (https://github.com/gogs/gogs/pull/7871). Users should upgrade to 0.13.1 or the latest 0.14.0+dev. ### Workarounds No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions. ### References https://www.cve.org/CVERecord?id=CVE-2024-39932

Advisory Timeline

First published December 23, 2024 (658 days ago).
Last revised December 23, 2024 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Update gogs.io/gogs to 0.13.1 or later

go get gogs.io/gogs@v0.13.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: go (1).

Package	Ecosystem	Affected	Fixed In
gogs.io/gogs	go	All versions	0.13.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-94
Code InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

References

Frequently Asked Questions

What is CVE-2024-39932?: Gogs allows argument injection during the previewing of changes This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2024-39932?: CVE-2024-39932 affects gogs.io/gogs. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-39932 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-9pp6-wq8c-3w2c

GHSA-hf29-9hfh-w63j

GO-2024-2971

Related CVEs

CVE-2022-1986
CRITICAL
OS Command Injection in file editor in Gogs
CVE-2026-52811
CRITICAL
Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym
CVE-2026-52813
CRITICAL
Gogs has Path Traversal in organization name that results in RCE through Git hooks
CVE-2024-39931
CRITICAL
Gogs allows deletion of internal files
CVE-2026-25921
CRITICAL
Gogs: Cross-repository LFS object overwrite via missing content hash verification
CVE-2025-64111
CRITICAL
Gogs's update .git/config file allows remote command execution
CVE-2026-52805
HIGH
Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft
CVE-2026-52816
MEDIUM
Gogs's Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leading to XSS

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies