CVE-2024-54148

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Gogs is an open source self-hosted Git service. A malicious user is able to commit and edit a crafted symlink file to a repository to gain SSH access to the server. The vulnerability is fixed in 0.13.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-22 CWE-61

Affected software

No affected versions have been published.

Timeline

Published: Dec 23, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-541498.4Winter is a free, open-source content management system (CMS) based on the Laravel PHP framework. Winter CMS prior to versions 1.2.7, 1.1.11 CVE-2024-54157.1A vulnerability have been discovered in PhpMyBackupPro affecting version 2.3 that could allow an attacker to execute XSS through /phpmybacku CVE-2024-541509.1cjwt is a C JSON Web Token (JWT) Implementation. Algorithm confusion occurs when a system improperly verifies the type of signature used, al CVE-2024-541517.5Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, whe CVE-2024-541529.3Angular Expressions provides expressions for the Angular.JS web framework as a standalone module. Prior to version 1.4.3, an attacker can wr CVE-2024-541536.5In JetBrains YouTrack before 2024.3.51866 unauthenticated database backup download was possible via vulnerable query parameter CVE-2024-541549.8In JetBrains YouTrack before 2024.3.51866 system takeover was possible through path traversal in plugin sandbox CVE-2024-541555.3In JetBrains YouTrack before 2024.3.51866 improper access control allowed listing of project names during app import without authentication CVE-2024-541566.5In JetBrains YouTrack before 2024.3.52635 multiple merge functions were vulnerable to prototype pollution attack CVE-2024-541576.5In JetBrains YouTrack before 2024.3.52635 potential ReDoS was possible due to vulnerable RegExp in Ruby syntax detector CVE-2024-541585.3In JetBrains YouTrack before 2024.3.52635 potential spoofing attack was possible via lack of Punycode encoding CVE-2024-541594.1stalld through 1.19.7 allows local users to cause a denial of service (file overwrite) via a /tmp/rtthrottle symlink attack.