CVE-2024-56731: Gogs deletion of internal files allows remote command execution

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-24 · updated 2026-06-17
Weakness: CWE-552

Description

Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.

Affected products

gogs: before 0.13.3 — fixed in 0.13.3

How to fix

Upgrade to a fixed version: gogs 0.13.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-56731 or the next vulnerability affects your stack