CVE-2024-54148

Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

Affected products

Gogs, Suse

Gogs

< 0.13.1

Fix

Available

CVSS 3.1

9.8 CRITICAL

EPSS

0.9% (55th percentile)

Weakness

CWE-61, CWE-22

NVD status

Analyzed

Published

2024-12-23

No exploit for CVE-2024-54148 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.