CVE-2024-39932

CRITICAL

Gogs allows argument injection during the previewing of changes

Published December 23, 2024Updated December 23, 2024Source: osv

Summary

### Impact Unprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user's code hosted on the same instance. ### Patches Unintended Git options has been ignored for diff preview (https://github.com/gogs/gogs/pull/7871). Users should upgrade to 0.13.1 or the latest 0.14.0+dev. ### Workarounds No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions. ### References https://www.cve.org/CVERecord?id=CVE-2024-39932

Remediation

Upgrade to the fixed version using your package manager.

Update gogs.io/gogs to 0.13.1 or later

go get gogs.io/gogs@v0.13.1

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Package	Ecosystem	Affected	Fixed In
gogs.io/gogs	go	All versions	0.13.1

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-94
Code InjectionMITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.9 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

References

Frequently Asked Questions

What is CVE-2024-39932?: Gogs allows argument injection during the previewing of changes This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.9/10).
How do I check if my project is affected by CVE-2024-39932?: CVE-2024-39932 affects gogs.io/gogs. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-39932 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

9.9

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-9pp6-wq8c-3w2c

GHSA-hf29-9hfh-w63j

GO-2024-2971

Related CVEs

CVE-2025-64111
CRITICAL
Gogs's update .git/config file allows remote command execution
CVE-2026-52806
CRITICAL
Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge
CVE-2026-52805
HIGH
Gogs has a Migration Redirect Bypass that Leads to Internal Repository Theft
CVE-2025-8110
HIGH
Gogs vulnerable to a bypass of CVE-2024-55947
CVE-2025-64175
HIGH
Gogs Vulnerable to 2FA Bypass via Recovery Code
CVE-2026-52797
HIGH
Gogs: Overwriting critical files results in a denial of service
CVE-2026-52800
HIGH
Gogs Vulnerable to CSRF Leading to Organization Owner Takeover
CVE-2024-55947
HIGH
Path Traversal in file update API in gogs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies