CVE-2024-39933
Duplicate Advisory: Gogs allows argument injection during the tagging of a new release
Gogs through 0.13.0 allows argument injection during the tagging of a new release.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Gogs through 0.13.0 allows argument injection during the tagging of a new release.
- Record
CVE-2024-39933- CVSS 3.1
- 7.7 High
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:C/UI:N - Weakness
- CWE-88
- Updated
- 2026-11-02
EUVDEUVD-2024-3599
Gogs through 0.13.0 allows argument injection during the tagging of a new release.
- Record
EUVD-2024-3599- CVSS 3.1
- 7.7 High
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:C/UI:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8mm6-wmpp-mmm3
Duplicate Advisory: Gogs allows argument injection during the tagging of a new release
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-m27m-h5gj-wwmg. This link is maintained to preserve external references.
Original Description
Gogs through 0.13.0 allows argument injection during the tagging of a new release. This vulnerability is still unfixed as of the time of this advisory being published.
- Record
GHSA-8mm6-wmpp-mmm3- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N - CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-88
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-m27m-h5gj-wwmg
Gogs allows argument Injection when tagging new releases
Impact
Unprivileged user accounts with at least one SSH key can read arbitrary files on the system. For instance, they could leak the configuration files that could contain database credentials ([database] *) and [security] SECRET_KEY. Attackers could also exfiltrate TLS certificates, other users' repositories, and the Gogs database when the SQLite driver is enabled.
Patches
Unintended Git options has been ignored for creating tags (https://github.com/gogs/gogs/pull/7872). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.
Workarounds
No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.
References
- Record
GHSA-m27m-h5gj-wwmg- CVSS 3.1
- 7.7 High
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:C/UI:N - Weakness
- CWE-88
- Updated
- 2026-11-02
NVD
Gogs through 0.13.0 allows argument injection during the tagging of a new release.
- Record
CVE-2024-39933- CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-88
- Updated
- 2026-11-02
OSV
Gogs through 0.13.0 allows argument injection during the tagging of a new release.
- Record
CVE-2024-39933- CVSS 3.1
- 7.7 High
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:C/UI:N - Updated
- 2026-11-02
OSVGHSA-8mm6-wmpp-mmm3
Duplicate Advisory: Gogs allows argument injection during the tagging of a new release
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-m27m-h5gj-wwmg. This link is maintained to preserve external references.
Original Description
Gogs through 0.13.0 allows argument injection during the tagging of a new release. This vulnerability is still unfixed as of the time of this advisory being published.
- Record
GHSA-8mm6-wmpp-mmm3- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N - CVSS 3.1
- 7.7 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N - Weakness
- CWE-88
- Updated
- 2026-11-02
OSVGHSA-m27m-h5gj-wwmg
Gogs allows argument Injection when tagging new releases
Impact
Unprivileged user accounts with at least one SSH key can read arbitrary files on the system. For instance, they could leak the configuration files that could contain database credentials ([database] *) and [security] SECRET_KEY. Attackers could also exfiltrate TLS certificates, other users' repositories, and the Gogs database when the SQLite driver is enabled.
Patches
Unintended Git options has been ignored for creating tags (https://github.com/gogs/gogs/pull/7872). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.
Workarounds
No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.
References
- Record
GHSA-m27m-h5gj-wwmg- CVSS 3.1
- 7.7 High
CVSS:3.1/AC:L/AV:N/A:N/C:H/I:N/PR:L/S:C/UI:N - Weakness
- CWE-88
- Updated
- 2026-11-02
OSVGO-2024-2972 No score
Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs
Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs
- Record
GO-2024-2972- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
gogs.io/gogsGo |
through 0.13.0 | 0.13.1 |
gogs.io/gogsGo |
before 0.13.1 | 0.13.1 |
github.com/gogs/gogsGo |
All versions | None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-39933 is a high vulnerability (CVSS 7.7) in Gogs, published July 4, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.69%, the 53rd percentile. Fixed in gogs.io/gogs 0.13.1.