CVE-2026-24135

Published Feb 6, 2026

Last updated 6 days ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-24135 describes a path traversal vulnerability found in Gogs, an open-source self-hosted Git service. This flaw specifically affects versions 0.13.3 and earlier of the software. The vulnerability resides within the `updateWikiPage` function. An authenticated user who possesses write access to a repository's wiki can exploit this by manipulating the `old_title` parameter in the wiki editing form. This manipulation allows the user to delete arbitrary files on the server. The issue has been addressed and patched in Gogs versions 0.13.4 and 0.14.0+dev.

Description: Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulating the old_title parameter in the wiki editing form. This issue has been patched in versions 0.13.4 and 0.14.0+dev.
Source: security-advisories@github.com
NVD status: Awaiting Analysis

Risk scores

CVSS 4.0

Type: Secondary
Base score: 7.2
Impact score: -
Exploitability score: -
Vector string: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity: HIGH

Weaknesses

security-advisories@github.com: CWE-22

Hype score: Not currently trending

References