Gogs Path Traversal Vulnerability: Critical RCE Threat Confirmed
Gogs has a confirmed path traversal vulnerability in organization names that can lead to remote code execution. Users of Gogs are advised to upgrade to the latest version.
What happened
Gogs, a self-hosted Git service, has a confirmed path traversal vulnerability (GHSA-c39w-43gm-34h5) in organization names. This vulnerability allows an attacker to store and retrieve data at arbitrary locations on the filesystem, leading to remote code execution through Git hooks. The vulnerability has been independently confirmed by multiple sources.
To assess your exposure, check if you are using Gogs and if any organization names contain path traversal sequences. The recommended action is to upgrade to the latest version of Gogs that patches this vulnerability. Additionally, avoid using path traversal sequences in organization names to mitigate the risk.
For more detailed information, consult the primary sources: [GHSA-89mr-xqfv-758m](https://github.com/advisories/GHSA-89mr-xqfv-758m), [GHSA-c39w-43gm-34h5](https://github.com/advisories/GHSA-c39w-43gm-34h5), and [GHSA-qf6p-p7ww-cwr9](https://github.com/advisories/GHSA-qf6p-p7ww-cwr9).
How 0Day mitigates this
gogs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.