What is CVE-2024-44625?

CVE-2024-44625 is a high-severity software vulnerability (Path traversal) with a CVSS score of 8.8. Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

Is CVE-2024-44625 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 15%.

What products does CVE-2024-44625 affect?

Tracked products affected include Gogs. Check the version you run to see whether it is affected.

How do I fix CVE-2024-44625?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

← All products

CVE-2024-44625

Q: Is CVE-2024-44625 being actively exploited?

It is not currently in CISA's KEV catalog. Its EPSS exploitation probability is 15%.

Q: What products does CVE-2024-44625 affect?

Tracked products affected include Gogs. Check the version you run to see whether it is affected.

Q: How do I fix CVE-2024-44625?

Apply the vendor fix promptly. Upgrade affected products to a fixed version.

HIGH severity · CVSS 8.8 · Path traversal

8.8CVSS HIGH

Summary

Gogs <=0.13.0 is vulnerable to Directory Traversal via the editFilePost function of internal/route/repo/editor.go.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredLow

User interactionNone

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)15%

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products we track (1)

Gogs

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Additional information

NVD record
https://gogs.io/
https://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs/Advisory