CVE-2026-24135: Path Traversal in Gogs

The primary impact of this vulnerability is the potential for arbitrary file deletion. An attacker who can successfully exploit this flaw could delete critical system files, configuration files, or application data, leading to a denial of service or even complete compromise of the Gogs server. The ability to delete files grants significant control over the affected system, potentially enabling further malicious actions. While the advisory notes potential false positives from vulnerability scanners, the core risk remains the ability to delete files via crafted wiki page updates.

1. Reserved2026-01-21
2. Published2026-02-17
3. Modified2026-02-19
4. EPSS updated2026-03-23

The recommended mitigation is to immediately upgrade Gogs to version 0.13.4 or later. If upgrading is not immediately feasible, consider implementing strict access controls to limit who can modify wiki pages. While a direct workaround is not available, restricting file system access for the Gogs process can limit the damage an attacker can inflict. Monitor Gogs logs for unusual file deletion attempts. After upgrading, verify the integrity of critical files and directories to ensure no unauthorized modifications occurred.