CVE-2024-56731: Gogs Critical Vulnerability Allows Remote Command Execution via .git Directory Manipulation
Summary
CVE-2024-56731: Gogs allows deletion of internal files which leads to remote command execution. Affects gogs.io/gogs versions < 0.13.3. Fixed in 0.13.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service that provides a simple and efficient way to manage Git repositories. It is designed for ease of use and offers features such as repository management, user access control, and a web-based interface. However, Gogs has been found to have a critical vulnerability that allows unprivileged users to manipulate files within the .git directory, potentially leading to severe security breaches.
Vulnerability Detail
The vulnerability arises from an insufficient patch for CVE-2024-39931, which aimed to prevent file uploads into the .git directory. Although a check was added to block direct access to the .git directory, the implementation fails to account for symbolic links. An attacker can create a symbolic link pointing to the .git directory, allowing them to delete arbitrary files and execute remote commands. This could lead to unauthorized access and manipulation of code hosted on the Gogs instance, compromising the integrity of the system.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.13.3
This is the first release that contains the fix.
go get gogs.io/gogs@v0.13.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict user permissions to prevent unprivileged users from creating symbolic links or accessing the .git directory. Additionally, consider monitoring file access within the .git directory to detect any unauthorized attempts.
Conclusion
The CVE-2024-56731 vulnerability in Gogs poses a significant risk due to its potential for remote command execution through .git directory manipulation. It is crucial for users to update to the patched version and implement necessary security measures to safeguard their instances.
See every vulnerability recorded for gogs.io/gogs →
FAQ
CVE-2024-56731 is a critical vulnerability in Gogs that allows unprivileged users to delete files in the .git directory, leading to potential remote command execution.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application's Gopkg.lock file for vulnerabilities without needing to install any software.
The risks include unauthorized command execution, potential data loss, and compromise of the integrity of the code hosted on the Gogs instance.
Yes, the vulnerability is patched in Gogs version 0.13.3. It is recommended to update to this version or later.
You can use Vulert's playground to check if your application is affected by this vulnerability. No signup is required, and it provides real-time alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
