{"id":"CVE-2024-55947","published":"2024-12-23T15:26:47Z","modified":"2024-12-24T15:59:02Z","title":"Gogs has a Path Traversal in file update API","vendor":"gogs","product":"gogs","tier":"core","eol":null,"affectedVersions":[{"vendor":"gogs","product":"gogs","versions":["< 0.13.1"]}],"description":{"text":"Gogs is an open source self-hosted Git service. A malicious user is able to write a file to an arbitrary path on the server to gain SSH access to the server. The vulnerability is fixed in 0.13.1.","provenance":"source","from":"CVE.org"},"summary":{"text":"The flaw is a path traversal in the file update API of Gogs, an open source self-hosted Git service, which lets the file-writing logic escape its intended directory. An attacker with low-privileged, authenticated access over the network, requiring no user interaction and no non-default configuration, can write a file to an arbitrary location on the server and use it to gain SSH access to the host.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:11:57Z"},"cvss":{"score":8.7,"severity":"HIGH","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.77836,"percentile":0.99569,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":3,"pulses":[{"name":"Gogs Zero-Day RCE (CVE-2025-8110) Actively Exploited","url":"https://otx.alienvault.com/pulse/69424397f9f6599878672724","created":"2025-12-17"},{"name":"Gogs 0-Day Vulnerability Exploited in the Wild to Hack 700+ Instances","url":"https://otx.alienvault.com/pulse/693c2881828e99f3e1d5ddb3","created":"2025-12-12"},{"name":"Gogs Zero-Day RCE (CVE-2025-8110) Actively Exploited","url":"https://otx.alienvault.com/pulse/6939bd82d7768abb3cf0a04a","created":"2025-12-10"}],"provenance":"machine"},"cwes":[{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory"}],"references":[{"url":"https://github.com/gogs/gogs/security/advisories/GHSA-qf5v-rp47-55gg","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/gogs/gogs/issues/7582","tags":["x_refsource_MISC"]},{"url":"https://github.com/gogs/gogs/pull/7859","tags":["x_refsource_MISC"]},{"url":"https://github.com/gogs/gogs/commit/9a9388ace25bd646f5098cb9193d983332c34e41","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.13.1"],"patched":["0.13.1"],"from":["GHSA-qf5v-rp47-55gg","GO-2024-3356"],"provenance":"source"}],"advisories":[{"id":"GHSA-qf5v-rp47-55gg","url":"https://github.com/advisories/GHSA-qf5v-rp47-55gg","severity":"HIGH","ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.13.1"],"patched":["0.13.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2024-3608","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-3608","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-06-23","earliestUrl":"https://github.com/ferralon-demo/gogs-symlink-chain","repos":[{"name":"ferralon-demo/gogs-symlink-chain","url":"https://github.com/ferralon-demo/gogs-symlink-chain","stars":0,"created":"2026-06-23"}]},"first":{"date":"2026-06-23","source":"PoC-in-GitHub","url":"https://github.com/ferralon-demo/gogs-symlink-chain"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2024-12-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2024-55947","provenance":"source"},{"date":"2026-06-23","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/ferralon-demo/gogs-symlink-chain","provenance":"source"}],"speed":{"daysToPublicExploit":547,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":32.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.91,"detail":"percentile 0.9957"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":1.37,"detail":"3 pulses"},{"name":"CVSS severity","points":6.09,"detail":"base score 8.7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}