CVE-2024-39932
Gogs allows argument injection during the previewing of changes
Gogs through 0.13.0 allows argument injection during the previewing of changes.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Gogs through 0.13.0 allows argument injection during the previewing of changes.
- Record
CVE-2024-39932- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N - Weakness
- CWE-94
- Updated
- 2026-11-02
EUVDEUVD-2024-3572
Gogs through 0.13.0 allows argument injection during the previewing of changes.
- Record
EUVD-2024-3572- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9pp6-wq8c-3w2c
Gogs allows argument injection during the previewing of changes
Impact
Unprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user's code hosted on the same instance.
Patches
Unintended Git options has been ignored for diff preview (https://github.com/gogs/gogs/pull/7871). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.
Workarounds
No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.
References
- Record
GHSA-9pp6-wq8c-3w2c- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N - Weakness
- CWE-94
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hf29-9hfh-w63j
Duplicate Advisory: Gogs allows argument injection during the previewing of changes
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9pp6-wq8c-3w2c. This link is maintained to preserve external references.
Original Description
Gogs through 0.13.0 allows argument injection during the previewing of changes.
- Record
GHSA-hf29-9hfh-w63j- CVSS 4.0
- 9.4 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
NVD
Gogs through 0.13.0 allows argument injection during the previewing of changes.
- Record
CVE-2024-39932- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSV
Gogs through 0.13.0 allows argument injection during the previewing of changes.
- Record
CVE-2024-39932- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N - Updated
- 2026-11-02
OSVGHSA-9pp6-wq8c-3w2c
Gogs allows argument injection during the previewing of changes
Impact
Unprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user's code hosted on the same instance.
Patches
Unintended Git options has been ignored for diff preview (https://github.com/gogs/gogs/pull/7871). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.
Workarounds
No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.
References
- Record
GHSA-9pp6-wq8c-3w2c- CVSS 3.1
- 9.9 Critical
CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGHSA-hf29-9hfh-w63j
Duplicate Advisory: Gogs allows argument injection during the previewing of changes
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9pp6-wq8c-3w2c. This link is maintained to preserve external references.
Original Description
Gogs through 0.13.0 allows argument injection during the previewing of changes.
- Record
GHSA-hf29-9hfh-w63j- CVSS 4.0
- 9.4 Critical
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H - CVSS 3.1
- 9.9 Critical
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-94
- Updated
- 2026-11-02
OSVGO-2024-2971 No score
Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs
Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs
- Record
GO-2024-2971- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gogs.io/gogsGo |
through 0.13.0 | 0.13.1 |
gogs.io/gogsGo |
before 0.13.1 | 0.13.1 |
github.com/gogs/gogsGo |
All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-39932 is a critical vulnerability (CVSS 9.9) in Gogs, published July 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 16.3%, the 96th percentile. Fixed in gogs.io/gogs 0.13.1.
References
github.com/gogs/gogs/releases
sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1
nvd.nist.gov/vuln/detail/CVE-2024-39932