Gogs anfällig für beliebiges Löschen von Dateien über Path Traversal bei Wiki-Seitenaktualisierung in gogs.io/gogs

The primary impact of this vulnerability is the potential for arbitrary file deletion. An attacker who can successfully exploit this flaw could delete critical system files, configuration files, or application data, leading to a denial of service or even complete compromise of the Gogs server. The ability to delete files grants significant control over the affected system, potentially enabling further malicious actions. While the advisory notes potential false positives from vulnerability scanners, the core risk remains the ability to delete files via crafted wiki page updates.

Self-hosted Gogs instances running versions prior to 0.13.4 are at risk. This includes organizations using Gogs for internal Git repositories and development teams relying on Gogs for code management. Shared hosting environments running Gogs are particularly vulnerable due to the potential for cross-tenant exploitation.

• go / binary: Examine Gogs binary for suspicious file deletion functions called during wiki page update processing. • linux / server: Monitor Gogs logs (typically in /var/log/gogs/) for unusual file deletion attempts, especially those involving paths outside of the intended wiki directory. Use journalctl -u gogs to filter relevant logs. • generic web: Monitor web server access logs for requests to wiki update endpoints with unusual path parameters. Use curl -v <gogsurl>/<wikiupdate_endpoint> to test for path traversal.

1. 2026-02-17Disclosure

   disclosure

1. Reserviert2026-01-21
2. Veröffentlicht2026-02-17
3. Geändert2026-02-19
4. EPSS aktualisiert2026-03-23

The recommended mitigation is to immediately upgrade Gogs to version 0.13.4 or later. If upgrading is not immediately feasible, consider implementing strict access controls to limit who can modify wiki pages. While a direct workaround is not available, restricting file system access for the Gogs process can limit the damage an attacker can inflict. Monitor Gogs logs for unusual file deletion attempts. After upgrading, verify the integrity of critical files and directories to ensure no unauthorized modifications occurred.