{"id":"CVE-2024-56731","published":"2025-06-24T03:37:42Z","modified":"2025-06-25T12:43:04Z","title":"Gogs deletion of internal files allows remote command execution","vendor":"gogs","product":"gogs","tier":"tail","description":{"text":"Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.","provenance":"source","from":"CVE.org"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.0115,"percentile":0.66783,"provenance":"source"},"cwes":[{"id":"CWE-552","name":"Files or Directories Accessible to External Parties"}],"references":[{"url":"https://github.com/gogs/gogs/security/advisories/GHSA-wj44-9vcg-wjq7","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/gogs/gogs/commit/77a4a945ae9a87f77e392e9066b560edb71b5de9","tags":["x_refsource_MISC"]},{"url":"https://github.com/gogs/gogs/releases/tag/v0.13.3","tags":["x_refsource_MISC"]}],"priority":{"score":20.4,"factors":[{"name":"EPSS percentile","points":13.36},{"name":"CVSS severity","points":7.0}]},"vendorSlug":"gogs","affectedVersions":[{"vendor":"gogs","product":"gogs","versions":["< 0.13.3"]}],"affected":[{"ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.13.3"],"patched":["0.13.3"],"from":["GHSA-wj44-9vcg-wjq7","GO-2025-3776"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-54695","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-gogs-cve-2024-39931","parents":[{"from":"CVE-2024-39931","to":"CVE-2024-56731","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931.","from":"CVE.org","in":"CVE-2024-56731"},{"kind":"osv-related","provenance":"source","id":"GHSA-wj44-9vcg-wjq7","via":"reference","url":"https://github.com/advisories/GHSA-ccqv-43vm-4f3w"},{"kind":"osv-related","provenance":"source","id":"GO-2025-3776","via":"reference","url":"https://github.com/advisories/GHSA-ccqv-43vm-4f3w"}]}],"children":[{"from":"CVE-2024-56731","to":"CVE-2025-64111","relation":"incomplete-fix","confidence":"high","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"incomplete-fix","quote":"In version 0.13.3 and prior, due to the insufficient patch for CVE-2024-56731, it's still possible to update files in the .git directory and achieve remote command execution.","from":"CVE.org","in":"CVE-2025-64111"}]}],"packageHistory":[{"cve":"CVE-2024-54148","published":"2024-12-23","fixed":"0.13.1","kev":false},{"cve":"CVE-2024-55947","published":"2024-12-23","fixed":"0.13.1","kev":false},{"cve":"CVE-2024-44625","published":"2024-11-15","fixed":"0.13.2","kev":false,"link":{"from":"CVE-2024-44625","to":"CVE-2024-56731","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:gogs.io/gogs","fromFixed":"0.13.2","toFixed":"0.13.3","daysApart":221}]}},{"cve":"CVE-2024-56731","published":"2025-06-24","fixed":"0.13.3","kev":false},{"cve":"CVE-2025-47943","published":"2025-06-24","fixed":"0.13.3-0.20250608224432-110117b2e5e5","kev":false,"link":{"from":"CVE-2024-56731","to":"CVE-2025-47943","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"Go:gogs.io/gogs","fromFixed":"0.13.3","toFixed":"0.13.3-0.20250608224432-110117b2e5e5","daysApart":0}]}},{"cve":"CVE-2025-64111","published":"2026-02-06","fixed":"0.13.4","kev":false},{"cve":"CVE-2025-64175","published":"2026-02-06","fixed":"0.13.4","kev":false}],"package":"Go:gogs.io/gogs"}}