{"id":"CVE-2024-39931","published":"2024-07-04T00:00:00Z","modified":"2024-08-02T04:33:11Z","title":"Gogs through 0.13.0 allows deletion of internal files","vendor":null,"product":null,"tier":"tail","description":{"text":"Gogs through 0.13.0 allows deletion of internal files.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.52658,"percentile":0.98965,"provenance":"source"},"cwes":[{"id":"CWE-552","name":"Files or Directories Accessible to External Parties"}],"references":[{"url":"https://github.com/gogs/gogs/releases","tags":[]},{"url":"https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1/","tags":[]}],"priority":{"score":26.7,"factors":[{"name":"EPSS percentile","points":19.79},{"name":"CVSS severity","points":6.93}]},"affected":[{"ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.13.1"],"patched":["0.13.1"],"from":["GHSA-ccqv-43vm-4f3w"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/gogs/gogs","vulnerableRanges":["all versions"],"patched":[],"from":["GO-2024-2970"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-3577","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-gogs-cve-2024-39931","children":[{"from":"CVE-2024-39931","to":"CVE-2024-56731","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931.","from":"CVE.org","in":"CVE-2024-56731"},{"kind":"osv-related","provenance":"source","id":"GHSA-wj44-9vcg-wjq7","via":"reference","url":"https://github.com/advisories/GHSA-ccqv-43vm-4f3w"},{"kind":"osv-related","provenance":"source","id":"GO-2025-3776","via":"reference","url":"https://github.com/advisories/GHSA-ccqv-43vm-4f3w"}]}]}}