| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/gogs/gogs | ≤ 0.13.0all versions | |
| gogs.io/gogs | < 0.13.1 | 0.13.1 |
| gogs | ≤ 0.13.0 |
Unprivileged user accounts can write to arbitrary files on the filesystem. We could demonstrate its exploitation to force a re-installation of the instance, granting administrator rights. It allows accessing and altering any user's code hosted on the same instance.
Unintended Git options has been ignored for diff preview (https://github.com/gogs/gogs/pull/7871). Users should upgrade to 0.13.1 or the latest 0.14.0+dev.
No viable workaround available, please only grant access to trusted users to your Gogs instance on affected versions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free