CVE-2026-24135 — Path Traversal in Gogs

CWE-22 — Path Traversal5 documents4 sources
Severity
7.2HIGHNVD
EPSS
0.1%
top 80.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
GogsGogs.io Gogs
Timeline
PublishedFeb 6
Latest updateFeb 17

Description

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulating the old_title parameter in the wiki editing form. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Packages3 packages

▶CVEListV5gogs/gogs< 0.14.0+dev
▶NVDgogs/gogs< 0.13.4
▶Gogogs.io/gogs< 0.13.4

🔴Vulnerability Details

3
OSV
Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update in gogs.io/gogs↗2026-02-17
▶
OSV
Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update↗2026-02-06
▶
GHSA
Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update↗2026-02-06
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-24135 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶