CVE-2024-39932: Gogs Arbitrary File Write Vulnerability
Summary
CVE-2024-39932: Gogs allows argument injection during the previewing of changes. Affects gogs.io/gogs versions < 0.13.1. Fixed in 0.13.1. How to fix ↓
Also tracked for
- github.com/gogs/gogs · Go
- github.com/gogs/gogs · Go
The same CVE-2024-39932 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is a self-hosted Git service that allows users to manage Git repositories with ease. It provides features such as repository hosting, issue tracking, and pull requests, making it a popular choice for developers looking for a lightweight alternative to larger Git services. However, Gogs has a critical vulnerability that allows unprivileged users to inject arguments during the previewing of changes, potentially leading to unauthorized file access and manipulation.
Vulnerability Detail
The vulnerability arises from improper handling of Git options during the diff preview process in Gogs. This flaw allows unprivileged user accounts to write to arbitrary files on the filesystem. An attacker could exploit this vulnerability to force a re-installation of the Gogs instance, thereby gaining administrator rights. This could lead to unauthorized access and alteration of any user's code hosted on the same instance, posing a significant risk to the integrity and security of the repositories.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.13.1
This is the first release that contains the fix.
go get gogs.io/gogs@v0.13.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no viable workarounds available. It is highly recommended to only grant access to trusted users on affected versions of Gogs until the patch is applied.
Conclusion
The CVE-2024-39932 vulnerability in Gogs poses a critical risk by allowing unprivileged users to write to arbitrary files, potentially compromising the entire instance. Users are urged to upgrade to the patched version immediately and restrict access to trusted individuals until the update is applied.
See every vulnerability recorded for gogs.io/gogs →
FAQ
CVE-2024-39932 is a critical vulnerability in Gogs that allows unprivileged users to perform arbitrary file writes on the filesystem.
If you are running Gogs version 0.13.0 or earlier, your instance is vulnerable. You can check your version in the Gogs admin panel.
Exploitation of this vulnerability can lead to unauthorized access to repositories, alteration of code, and potential takeover of the Gogs instance.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software without needing to access the code or installation.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
