CVE-2024-56731

Aliases:GHSA-wj44-9vcg-wjq7GO-2025-3776
Advisory lineage Upstream: 0 Downstream: 1
Analyzed
Published: 24 Jun 2025, 03:37
Last modified:25 Jun 2025, 12:43

Vulnerability Summary

Overall Risk (default)
high
70/100
CVSS Score
10 CRITICAL
v3.1 (cve.org)
EPSS Score
2.58% LOW
3% probability +1.85%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

24 Jun 2025, 03:37
Published
Vulnerability first disclosed
25 Jun 2025, 12:43
Last Modified
Vulnerability information updated

Description

Gogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve remote command execution due to an insufficient patch for CVE-2024-39931. Unprivileged user accounts can execute arbitrary commands on the Gogs instance with the privileges of the account specified by RUN_USER in the configuration. Allowing attackers to access and alter any users' code hosted on the same instance. This issue has been patched in version 0.13.3.

CVSS Metrics

  • v3.1•CRITICAL•Score: 10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
  • v3.1•CRITICAL•Score: 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 2.58%• Percentile: 86%

Techniques & Countermeasures

  • CWE-552•Files or Directories Accessible to External Parties

    The product makes files or directories accessible to unauthorized actors, even though they should not be.

Affected Systems

  • Unknown•Gogs

    < 0.13.3

  • gogs.io•gogs

    < 0.13.3

References (6)