CVE-2024-56731

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.3

Description An insufficient patch for a previous issue allows unprivileged user accounts to delete files within the .git directory. This is possible because the system fails to check for symbolic links that point to the .git directory, bypassing existing security checks. Consequently, an attacker can achieve remote command execution with the privileges of the account defined by the RUN USER variable in the configuration. This allows unauthorized access to and modification of code hosted by any user on the same instance.

Recommendations Update Gogs to version 0.13.3.