{"id":"CVE-2024-56731","aliases":["EUVD-2024-54695","GHSA-wj44-9vcg-wjq7","GO-2025-3776","openSUSE-SU-2025:15405-1"],"status":"published","title":"Gogs deletion of internal files allows remote command execution","description":"Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0115,"percentile":0.67349,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-552"],"published":"2025-06-24T03:37:42Z","modified":"2026-10-28T02:30:31Z","fixes":[{"ecosystem":"Go","package":"gogs.io/gogs","fixed_in":["0.13.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"gogs.io/gogs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.13.2"},{"fixed":"0.13.3"}]}]},{"source":"osv","ecosystem":"Go","package":"gogs.io/gogs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.13.3"}]}]},{"source":"osv","ecosystem":"Go","package":"gogs.io/gogs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.13.3"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"govulncheck-vulndb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.20250730T213748-1.1"}]}],"bundled":56}],"products":[{"vendor":"gogs","product":"gogs"}],"references":[{"url":"https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7","tags":["x_refsource_CONFIRM","Patch","Vendor Advisory","advisory","web"]},{"url":"https://github.com/gogs/gogs/commit/77a4a945ae9a87f77e392e9066b560edb71b5de9","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/gogs/gogs/releases/tag/v0.13.3","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-56731","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ccqv-43vm-4f3w","tags":["advisory","web"]},{"url":"https://github.com/advisories/GHSA-wj44-9vcg-wjq7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56731.json","tags":["advisory"]},{"url":"https://github.com/gogs/gogs","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44905","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-44906","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-56731","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-0928","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-30086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-32019","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3228","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3415","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4563","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4656","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-46702","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4674","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47281","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47943","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-4981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-49825","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5030","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-51471","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52477","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52889","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52890","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52894","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52900","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52901","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52903","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52995","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52996","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-52997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53512","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53513","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53547","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53632","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53634","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53826","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53893","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-53945","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-54379","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5981","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6023","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6226","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6227","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6233","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-6624","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-56731","title":"Gogs deletion of internal files allows remote command execution","description":"Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.","status":"published","published":"2025-06-24T03:37:42.327Z","modified":"2025-06-25T12:43:04.424Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:33:58.357949Z"}],"euvd":[{"id":"EUVD-2024-54695","description":"Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.","status":"published","published":"2025-06-24T03:37:42Z","modified":"2025-06-25T12:43:04Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:16.964954Z"}],"ghsa":[{"id":"GHSA-wj44-9vcg-wjq7","title":"Gogs allows deletion of internal files which leads to remote command execution","description":"### Summary\nDue to the insufficient patch for the CVE-2024-39931, it's still possible to delete files under the `.git` directory and achieve remote command execution.\n\n### Details\nIn the patch for CVE-2024-39931, the following check is added:\nhttps://github.com/gogs/gogs/commit/77a4a945ae9a87f77e392e9066b560edb71b5de9\n\n```diff\n+\t// 🚨 SECURITY: Prevent uploading files into the \".git\" directory\n+\tif isRepositoryGitPath(opts.TreePath) {\n+\t\treturn errors.Errorf(\"bad tree path %q\", opts.TreePath)\n+\t}\n```\n\n\nWhile the above code snippet checks if the specified path is a `.git` directory, there are no checks for symbolic links in the later steps. So, by creating a symbolic link that points to the `.git` directory, an attacker can still delete arbitrary files in the `.git` directory and achieve remote command execution.\n\n### Impact\nUnprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by `RUN_USER` in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.","status":"published","published":"2025-06-24T19:00:20Z","modified":"2025-06-24T19:00:21Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:38:47.835488Z"}],"nvd":[{"id":"CVE-2024-56731","description":"Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.","status":"published","published":"2025-06-24T04:15:45.813Z","modified":"2026-06-17T08:12:51.593Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T14:10:47.073504Z"}],"osv":[{"id":"CVE-2024-56731","title":"Gogs deletion of internal files allows remote command execution","description":"Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.","status":"published","published":"2025-06-24T03:37:42.327Z","modified":"2026-10-28T02:30:31.027360767Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T15:44:44.777182Z"},{"id":"GHSA-wj44-9vcg-wjq7","title":"Gogs allows deletion of internal files which leads to remote command execution","description":"### Summary\nDue to the insufficient patch for the CVE-2024-39931, it's still possible to delete files under the `.git` directory and achieve remote command execution.\n\n### Details\nIn the patch for CVE-2024-39931, the following check is added:\nhttps://github.com/gogs/gogs/commit/77a4a945ae9a87f77e392e9066b560edb71b5de9\n\n```diff\n+\t// 🚨 SECURITY: Prevent uploading files into the \".git\" directory\n+\tif isRepositoryGitPath(opts.TreePath) {\n+\t\treturn errors.Errorf(\"bad tree path %q\", opts.TreePath)\n+\t}\n```\n\n\nWhile the above code snippet checks if the specified path is a `.git` directory, there are no checks for symbolic links in the later steps. So, by creating a symbolic link that points to the `.git` directory, an attacker can still delete arbitrary files in the `.git` directory and achieve remote command execution.\n\n### Impact\nUnprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by `RUN_USER` in the configuration. It allows attackers to access and alter any users' code hosted on the same instance.","status":"published","published":"2025-06-24T19:00:20Z","modified":"2025-07-28T20:42:04.801588Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-552"],"updated_at":"2026-11-02T15:46:58.767335Z"},{"id":"GO-2025-3776","title":"Gogs allows deletion of internal files which leads to remote command execution in gogs.io/gogs","description":"Gogs allows deletion of internal files which leads to remote command execution in gogs.io/gogs","status":"published","published":"2025-07-28T19:57:13Z","modified":"2026-03-03T04:57:20.223991Z","updated_at":"2026-11-02T15:47:01.728182Z"},{"id":"openSUSE-SU-2025:15405-1","title":"govulncheck-vulndb-0.0.20250730T213748-1.1 on GA media","description":"These are all security issues fixed in the govulncheck-vulndb-0.0.20250730T213748-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-04T00:00:00Z","modified":"2026-03-23T04:53:44.42671Z","updated_at":"2026-11-02T16:58:37.810934Z"}]}}