CVE-2024-44625
Published: 15 November 2024
Summary
CVE-2024-44625 is a high-severity Path Traversal (CWE-22) vulnerability in Gogs Gogs. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Gogs versions 0.13.0 and earlier are affected by a directory traversal vulnerability in the editFilePost function located in internal/route/repo/editor.go, tracked as CWE-22. The flaw received a CVSS 3.1 score of 8.8, reflecting network attack vector, low complexity, and low privileges required without user interaction.
An authenticated attacker can supply crafted input to the affected function to traverse directories on the server, enabling unauthorized access to files and ultimately remote code execution that impacts confidentiality, integrity, and availability.
Public references describe the issue as unpatched, with the Gogs project site providing no indication of an available fix or mitigation guidance at the time of disclosure.
The associated EPSS score stands at 0.8179, indicating substantial exploitation probability.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-3293
Vulnerability details
Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Validates pathnames and filenames to prevent traversal outside intended directories.