CVE-2024-55947: Gogs Path Traversal Vulnerability

CVE-2024-55947 Overview

CVE-2024-55947 is a path traversal vulnerability [CWE-22] in Gogs, an open-source self-hosted Git service. An authenticated malicious user can write a file to an arbitrary path on the server through the repository file editing API. By writing a crafted file to a sensitive filesystem location, an attacker can gain SSH access to the underlying server. The vulnerability affects Gogs versions prior to 0.13.1 and is fixed in 0.13.1.

Critical Impact
An authenticated attacker can achieve full server compromise by writing files outside the intended repository directory, escalating from low-privilege repository access to SSH-level control of the host.

Affected Products

Gogs versions prior to 0.13.1
Self-hosted Gogs Git service deployments
All operating systems running vulnerable Gogs instances

Discovery Timeline

2024-12-23 - CVE-2024-55947 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55947

Vulnerability Analysis

The vulnerability resides in the repository content update API path of Gogs. When a user uploads or edits files in a repository, the server accepts a file name and path from the request. The application failed to properly sanitize the upload.Name field before writing the file to disk, allowing directory traversal sequences such as ../ to escape the intended repository directory.

An attacker with credentials to any repository can craft an API request that writes arbitrary content to any file location accessible to the Gogs process. Writing to the Gogs user's ~/.ssh/authorized_keys file grants the attacker SSH access to the host operating the service.

Root Cause

The root cause is missing input sanitization on user-supplied file paths in internal/database/repo_editor.go. The pathutil.Clean helper existed but was not invoked on the upload.Name value prior to file system operations. Path components containing .. were passed unmodified to file write routines.

Attack Vector

Exploitation requires network access to the Gogs web interface or API and low-privilege authenticated credentials with write access to at least one repository. No user interaction is required. The attacker submits a repository file update request containing a file name with directory traversal sequences.

// Security patch in internal/database/repo_editor.go
// Source: https://github.com/gogs/gogs/commit/9a9388ace25bd646f5098cb9193d983332c34e41
			continue
		}

		// 🚨 SECURITY: Prevent path traversal.
		upload.Name = pathutil.Clean(upload.Name)

		// 🚨 SECURITY: Prevent uploading files into the ".git" directory

// Security patch in internal/pathutil/pathutil.go
// Source: https://github.com/gogs/gogs/commit/9a9388ace25bd646f5098cb9193d983332c34e41

// Clean cleans up given path and returns a relative path that goes straight
// down to prevent path traversal.
//
// 🚨 SECURITY: This function MUST be used for any user input that is used as
// file system path to prevent path traversal.
func Clean(p string) string {
	p = strings.ReplaceAll(p, `\`, "/")
	return strings.Trim(path.Clean("/"+p), "/")

The patch enforces pathutil.Clean on the upload.Name value and hardens the Clean function documentation to make path traversal prevention explicit for all future callers.

Detection Methods for CVE-2024-55947

Indicators of Compromise

Unexpected modifications to ~/.ssh/authorized_keys for the Gogs service account
New or modified files outside repository storage directories owned by the Gogs process user
API requests to repository content update endpoints containing .., ../, or URL-encoded traversal sequences in file name parameters
Unusual SSH login sessions originating from IP addresses not associated with legitimate administrators

Detection Strategies

Inspect Gogs application and reverse proxy logs for PUT or POST requests to repository file APIs containing traversal patterns in name or tree_path fields
Enable file integrity monitoring on the Gogs service account home directory and system configuration paths
Correlate repository write operations with subsequent filesystem changes outside repository storage locations

Monitoring Recommendations

Alert on any write operations to authorized_keys, cron directories, or shell profile files by the Gogs process
Monitor SSH authentication events for the Gogs service account and flag interactive logins
Review Gogs audit logs for privilege changes and repository creation events preceding suspicious file system activity

How to Mitigate CVE-2024-55947

Immediate Actions Required

Upgrade all Gogs instances to version 0.13.1 or later without delay
Audit the Gogs service account's ~/.ssh/authorized_keys file and remove unrecognized entries
Rotate SSH keys and administrative credentials on any host where a vulnerable Gogs instance ran
Review repository editing API logs since deployment for traversal payloads and unauthorized file writes

Patch Information

The fix is delivered in Gogs 0.13.1 via commit 9a9388a and pull request #7859. Full technical details are available in the GitHub Security Advisory GHSA-qf5v-rp47-55gg.

Workarounds

Restrict repository write access to trusted users only until patching is complete
Run the Gogs service under a dedicated low-privilege account with no shell and no SSH login capability
Place the Gogs storage directory on a filesystem mount that limits the service account's write scope
Disable password-based SSH authentication on the host and restrict authorized_keys file permissions and ownership

bash

# Configuration example - harden the Gogs service account
sudo usermod -s /usr/sbin/nologin git
sudo chmod 600 /home/git/.ssh/authorized_keys
sudo chattr +i /home/git/.ssh/authorized_keys

# Verify installed Gogs version
gogs --version