CVE-2024-54148: Remote Command Execution Vulnerability in gogs.io/gogs
Summary
CVE-2024-54148: Remote Command Execution in file editing in gogs in gogs.io/gogs. Affects gogs.io/gogs versions < 0.13.1. Fixed in 0.13.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is a self-hosted Git service that allows users to manage their Git repositories with ease. It is designed to be lightweight and easy to install, providing features such as repository management, issue tracking, and user management. However, a critical vulnerability has been identified that exposes users to remote command execution risks during file editing operations.
Vulnerability Detail
The vulnerability arises from improper handling of user inputs in the file editing functionality of Gogs. This flaw allows an attacker to execute arbitrary commands on the server, potentially leading to unauthorized access, data breaches, or complete system compromise. The issue affects all versions of Gogs prior to 0.13.1, making it imperative for users to update to the fixed version to mitigate risks.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.13.1
This is the first release that contains the fix.
go get gogs.io/gogs@v0.13.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the file editing functionality by implementing strict access controls and monitoring user permissions until the update can be applied.
Conclusion
CVE-2024-54148 represents a significant security risk for users of Gogs prior to version 0.13.1. It is crucial for users to update their installations promptly to mitigate the risk of remote command execution. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for gogs.io/gogs →
FAQ
CVE-2024-54148 is a vulnerability in Gogs that allows remote command execution through improper handling of user inputs in file editing.
If you are running a version of Gogs prior to 0.13.1, your installation is vulnerable to CVE-2024-54148.
An attacker could exploit this vulnerability to execute arbitrary commands on the server, leading to unauthorized access and potential data breaches.
Yes, you can use Vulert to monitor and alert in real-time for open-source vulnerabilities in your software. Visit https://vulert.com for more information.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
