CVE-2024-55947: Path Traversal in gogs.io/gogs

The Path Traversal vulnerability in gogs.io/gogs allows an attacker to bypass intended file access restrictions. By manipulating the file update API, an attacker can craft requests that include directory traversal sequences (e.g., ../) to access files outside of the intended directory. This could lead to the exposure of sensitive configuration files, source code, database credentials, or other critical data stored on the server. The potential impact is significant, as an attacker could gain a deeper understanding of the system's architecture and potentially exploit other vulnerabilities.

1. Reserved2024-12-13
2. Published2025-01-07
3. Modified2026-03-03
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-55947 is to upgrade gogs.io/gogs to version 0.13.1 or later, which contains the fix. If upgrading immediately is not feasible, consider implementing temporary workarounds such as restricting file upload locations and carefully validating user input to prevent directory traversal attempts. Web application firewalls (WAFs) configured to detect and block directory traversal patterns can also provide an additional layer of protection. After upgrading, confirm the fix by attempting a file update request with a malicious path traversal sequence and verifying that access is denied.