CVE-2024-56731: Remote Command Execution Vulnerability in Gogs Package
Summary
CVE-2024-56731: Gogs allows deletion of internal files which leads to remote command execution in gogs.io/gogs. Affects gogs.io/gogs versions < 0.13.3. Fixed in 0.13.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service that provides a simple and efficient way to manage Git repositories. It is designed for ease of use and offers features such as repository management, issue tracking, and collaboration tools. However, Gogs has a critical vulnerability that allows unauthorized deletion of internal files, potentially leading to remote command execution.
Vulnerability Detail
The vulnerability identified as CVE-2024-56731 in the Gogs package allows attackers to delete internal files. This flaw arises from improper validation of user inputs, which can be exploited to execute arbitrary commands on the server. The ramifications of this vulnerability are severe, as it can lead to a complete compromise of the affected system, allowing attackers to gain control and manipulate the server environment.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.13.3
This is the first release that contains the fix.
go get gogs.io/gogs@v0.13.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the Gogs application and ensure that only trusted users have the ability to interact with the system. Additionally, monitoring logs for unusual activities can help mitigate potential exploitation until the package is updated.
Conclusion
The CVE-2024-56731 vulnerability in the Gogs package poses a significant risk due to its potential for remote command execution. Users are strongly encouraged to update to the patched version 0.13.3 to mitigate this risk. Until the update is applied, implementing access restrictions and monitoring can help reduce the likelihood of exploitation.
See every vulnerability recorded for gogs.io/gogs →
FAQ
CVE-2024-56731 is a vulnerability in the Gogs package that allows for remote command execution due to improper file deletion.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which monitors open-source vulnerabilities without requiring any signup.
The risks include unauthorized access to the server, potential data loss, and complete system compromise, allowing attackers to execute arbitrary commands.
Yes, the vulnerability has been patched in version 0.13.3 of the Gogs package. It is recommended to update to this version or later.
If immediate updating is not possible, restrict access to the application and monitor for any suspicious activities as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
