← Vulnerability feed

Vulnerability record · CVE-2024-39931 · published 4 July 2024

CVE-2024-39931: Gogs internal file deletion via path handling flaw

Gogs · Gogs

Gogs through 0.13.0 allows deletion of internal files. The flaw is a path handling issue (CWE-552) that lets a user with a valid account remove files the application relies on, which can break the instance or expose it to further abuse. It matters because the affected software is a self-hosted Git service often holding source code and credentials.

9.9 CVSS 3.1 Critical EPSS 53% · top 1.1% CWE-552 · CWE-552
9.9CVSS 3.1 base score
53%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

Gogs through 0.13.0 allows deletion of internal files.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS 9.9 critical with scope change and a very high EPSS percentile, though exploitation is not confirmed in KEV.

What it is

Gogs through 0.13.0 allows deletion of internal files. The flaw is a path handling issue (CWE-552) that lets a user with a valid account remove files the application relies on, which can break the instance or expose it to further abuse. It matters because the affected software is a self-hosted Git service often holding source code and credentials.

Impact

An authenticated attacker can delete internal files on the Gogs server, causing loss of integrity and availability of the service. The CVSS scope change indicates the impact can extend beyond the vulnerable component.

Attack surface

Reachable over the network through the Gogs web interface or API; the vector requires low privileges (PR:L) and no user interaction (UI:N). No authentication bypass is needed, but a valid account is required.

Exploitation

Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is 0.52658 (98.9th percentile), indicating a high predicted likelihood of exploitation activity.

What to do

  • Upgrade Gogs to a release after 0.13.0 once a fixed version is available; the record does not name a patched version.
  • Restrict account creation and review existing user privileges to limit who can reach the vulnerable functionality.
  • Run Gogs with least privilege and isolate it from sensitive host filesystems.
  • Monitor the Gogs release notes and SonarSource advisory for a patch and apply it promptly.

Detection

  • Alert on unexpected deletion or modification of files under the Gogs installation and data directories.
  • Audit Gogs application logs for file deletion requests from authenticated users, especially unusual paths.
  • Watch for service instability or missing internal files that correlate with recent user activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/gogs/gogs/releases Release Notes
https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1/ Third Party Advisory
https://github.com/gogs/gogs/releases Release Notes
https://www.sonarsource.com/blog/securing-developer-tools-unpatched-code-vulnerabilities-in-gogs-1/ Third Party Advisory

Track CVE-2024-39931 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.7CVE-2025-8110Gogs PutContents API symlink handling allows remote code executionThe PutContents API in Gogs mishandles symbolic links, letting a user write file content through a symlink and escape the intended repository path (C…KEVEPSS 85%analysed9.9CVE-2024-39930Gogs argument injection vulnerabilityThe built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated atta…EPSS 7.7%9.9CVE-2024-39932Gogs code injection vulnerabilityGogs through 0.13.0 allows argument injection during the previewing of changes.EPSS 17%9.8CVE-2024-56731Gogs vulnerabilityGogs is an open source self-hosted Git service. Prior to version 0.13.3, it's still possible to delete files under the .git directory and achieve rem…EPSS 1.2%9.8CVE-2022-1884Gogs os command injection vulnerabilityA remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to imp…EPSS 1.8%9.8CVE-2022-2024Gogs OS command injection before 0.12.11Gogs, a self-hosted Git service, contains an OS command injection flaw (CWE-78) in versions prior to 0.12.11. The CVSS 3.1 vector rates it 9.8 critic…EPSS 98%analysed9.8CVE-2022-1986Gogs os command injection vulnerabilityOS Command Injection in GitHub repository gogs/gogs prior to 0.12.9.EPSS 4.5%9.8CVE-2019-14544Gogs missing authorization vulnerabilityroutes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.EPSS 1.5%

Source: NIST National Vulnerability Database (record CVE-2024-39931), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.