CVE-2024-44625: Gogs Path Traversal Vulnerability

CVE-2024-44625 Overview

CVE-2024-44625 is a directory traversal vulnerability in Gogs, a self-hosted Git service written in Go. The flaw resides in the editFilePost function of internal/route/repo/editor.go and affects Gogs versions <=0.13.0. An authenticated attacker can supply a crafted file path when editing repository files to write content outside the intended repository directory. Successful exploitation can lead to remote code execution on the Gogs host. The issue is tracked under CWE-22: Path Traversal.

Critical Impact
Authenticated attackers can write arbitrary files on the Gogs server through the file editor, enabling remote code execution and full compromise of the repository host.

Affected Products

Gogs versions <=0.13.0
Self-hosted Gogs instances exposing the web editor
Multi-tenant Gogs deployments allowing user account registration

Discovery Timeline

2024-11-15 - CVE-2024-44625 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-44625

Vulnerability Analysis

Gogs exposes a web-based file editor that lets authenticated users create and modify files in repositories they can access. The editFilePost handler in internal/route/repo/editor.go receives the target file path from user input and passes it to the file write logic without sufficient sanitization of traversal sequences.

By submitting a path containing ../ segments, an attacker can escape the repository working directory. The write operation then lands on arbitrary locations reachable by the Gogs process user. Depending on file system layout and service privileges, the attacker can overwrite configuration files, SSH authorized_keys, cron entries, or Git server-side hooks, resulting in remote code execution. Additional technical analysis is available in the Fysac blog post on unpatched Gogs RCE.

Root Cause

The root cause is missing canonicalization and validation of the file path parameter accepted by editFilePost. The handler trusts the client-supplied path and joins it with the repository directory without rejecting .. components or absolute paths, violating CWE-22 guidance for safe path handling in Go services.

Attack Vector

Exploitation requires network access to the Gogs web interface and a valid user account with write permission to at least one repository, which is trivial to obtain on instances that allow self-registration. The attacker opens the web editor, submits a modified path such as one traversing outside the repository tree, and posts arbitrary file contents. The Gogs process writes the payload wherever its file system permissions allow, giving the attacker a primitive to plant executable content or hijack service configuration.

No verified public exploit code is referenced in the CVE record, but the referenced write-up describes the exploitation chain in detail.

Detection Methods for CVE-2024-44625

Indicators of Compromise

HTTP POST requests to Gogs editor endpoints under /{user}/{repo}/_edit/ containing .., URL-encoded %2e%2e, or absolute paths in the tree_path or file name parameter
Unexpected files appearing outside repository directories under the Gogs data path, particularly in the Gogs user home directory (.ssh/authorized_keys, .bashrc) or system directories
New or modified Git server-side hooks (pre-receive, post-receive, update) written outside standard administrative workflows
Gogs process spawning shells, sh, bash, or network utilities such as curl and wget from repository or hook contexts

Detection Strategies

Alert on web server logs where the editor path parameter contains traversal sequences or encoded variants
Monitor file integrity on directories adjacent to the Gogs repository root, including the service account home directory and any writable system paths
Correlate authenticated Gogs sessions with process creation events from the gogs binary to identify post-exploit command execution

Monitoring Recommendations

Enable and centralize Gogs access logs, application logs, and reverse-proxy logs for retrospective hunting
Track newly created SSH keys, cron jobs, and systemd units on Gogs hosts and alert on changes outside change-management windows
Baseline outbound network activity from the Gogs host and alert on new destinations that could indicate a reverse shell or data exfiltration

How to Mitigate CVE-2024-44625

Immediate Actions Required

Restrict network exposure of Gogs instances to trusted networks or VPN users until a fix is deployed
Disable self-service user registration and audit existing accounts with repository write access
Review Gogs hosts for unexpected files, SSH keys, and hook scripts introduced since November 2024
Rotate credentials and SSH keys stored on or accessible from the Gogs host if compromise is suspected

Patch Information

At the time of the referenced disclosure, no vendor patch was linked in the CVE record for versions <=0.13.0. Administrators should track the Gogs project for updated releases and apply any security fix that addresses editFilePost path handling in internal/route/repo/editor.go. Organizations with strict risk tolerance should evaluate migration to an actively maintained Git server.

Workarounds

Run Gogs as an unprivileged user in a container or chroot to limit the reach of arbitrary file writes
Place Gogs behind a reverse proxy that rejects request bodies and paths containing .., %2e%2e, or absolute paths targeting the editor endpoints
Remove write permissions from the Gogs service account for any directory outside the repository data path, including its home directory
Restrict repository write access to a minimal set of trusted users and enforce multi-factor authentication on identity providers fronting Gogs

bash

# Example reverse-proxy rule (NGINX) to block traversal on editor endpoints
location ~ ^/[^/]+/[^/]+/_edit/ {
    if ($request_uri ~* "(\.\./|%2e%2e/|%2e%2e%2f)") {
        return 403;
    }
    proxy_pass http://gogs_upstream;
}