CVE-2026-24135
Published: 06 February 2026
Summary
CVE-2026-24135 is a high-severity Path Traversal (CWE-22) vulnerability in Gogs Gogs. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique File Deletion (T1070.004); ranked at the 46.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2026-24135 is a path traversal vulnerability (CWE-22) in the updateWikiPage function of Gogs, an open-source self-hosted Git service. It affects version 0.13.3 and prior. The flaw enables manipulation of the old_title parameter in the wiki editing form, allowing unauthorized file access and deletion outside the intended directory.
An authenticated user with write access to a repository's wiki can exploit this vulnerability remotely over the network with low complexity and no user interaction required. Successful exploitation grants the ability to delete arbitrary files on the server, resulting in high integrity and availability impacts (CVSS 8.1: AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H), while confidentiality remains unaffected.
The Gogs security advisory at https://github.com/gogs/gogs/security/advisories/GHSA-jp7c-wj6q-3qf2 confirms the issue and states it has been patched in versions 0.13.4 and 0.14.0+dev. Security practitioners should upgrade to a patched version immediately to mitigate the risk.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5642
Vulnerability details
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary…
more
files on the server by manipulating the old_title parameter in the wiki editing form. This issue has been patched in versions 0.13.4 and 0.14.0+dev.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Path traversal enables arbitrary file deletion outside intended wiki directories, directly facilitating file deletion (T1070.004) and data destruction (T1485) by an authenticated user.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the path traversal vulnerability by validating the old_title parameter to prevent traversal sequences from accessing arbitrary files.
Requires timely remediation of the specific flaw in Gogs' updateWikiPage function through patching to versions 0.13.4 or later.
Enforces logical access controls to restrict authenticated wiki write users from performing unauthorized file deletions outside intended directories.