CVE-2026-24135: Gogs.io/gogs Path Traversal Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-jp7c-wj6q-3qf2",
  "modified" : "2026-02-06T19:07:01Z",
  "published" : "2026-02-06T18:16:25Z",
  "aliases" : [ "CVE-2026-24135" ],
  "summary" : "Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update",
  "details" : "### Summary\nA Path Traversal vulnerability exists in the `updateWikiPage` function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulating the `old_title` parameter in the wiki editing form.\n\n### Vulnerability Deatils\nThe vulnerability is located in `internal/database/wiki.go`. When updating a wiki page, the application accepts an `old_title` parameter to identify the potential rename operation. This parameter is used directly in `path.Join` and `os.Remove` without proper sanitization.\n\nCode snippet from `internal/database/wiki.go`:\n```go\n// Line 114\nos.Remove(path.Join(localPath, oldTitle+\".md\"))\n```\n\nIf an attacker provides a path traversal sequence (e.g., `../../../../target`) as `old_title`, the `os.Remove` function will resolve the path relative to the wiki's local directory and delete the target file. The vulnerability is limited to deleting files that end with `.md` (due to the appended extension), but depending on the filesystem and specific `path.Join` behavior, or if critical `.md` files exist (e.g. documentation, other wikis), the impact is significant. Additionally, in some contexts, the extension might be bypassed or ignored.\n\n### Impact\n- **Denial of Service**: Deletion of critical configuration files or data (if they match the extension or via other tricks).\n- **Data Loss**: Deletion of other users' wiki pages or documentation.\n\n### Remediation\nSanitize the `oldTitle` parameter using `ToWikiPageName` (or `path.Clean` and basename validation) before using it in file operations, similar to how the new `title` is currently handled.\n\n```go\n// Recommended Fix\nif oldTitle != \"\" {\n    oldTitle = ToWikiPageName(oldTitle)\n}\n```\n\n### Reproduction Steps\n1.  Log in to Gogs as a user with write access to a repository wiki.\n2.  Intercept the `POST` request to `/repo/wiki/edit`.\n3.  Modify the `old_title` parameter to `../../../../tmp/target_file`.\n4.  Submit the request.\n5.  Observe that `/tmp/target_file.md` is deleted from the server.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "gogs.io/gogs"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.13.4"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.13.3"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/security/advisories/GHSA-jp7c-wj6q-3qf2"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-24135"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/gogs/gogs"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-06T18:16:25Z",
    "nvd_published_at" : "2026-02-06T18:15:57Z"
  }
}