CVE-2026-24135: 
Gogs vulnerability analysis and mitigation

CVE-2026-24135 is a path traversal vulnerability in Gogs, an open-source self-hosted Git service, that allows authenticated users with wiki write access to delete arbitrary files on the server. The flaw exists in the updateWikiPage function and was disclosed on February 6, 2026. It affects Gogs versions 0.13.3 and prior, with patches available in versions 0.13.4 and 0.14.0+dev. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) and a CVSS v4.0 base score of 7.2 (High) (GitHub Advisory, Gogs Security Advisory).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) and is located in internal/database/wiki.go within the updateWikiPage function (Gogs Security Advisory). When a wiki page is updated, the application accepts an old_title parameter to handle rename operations; this parameter is passed directly to path.Join and os.Remove without sanitization, as shown in the vulnerable code: os.Remove(path.Join(localPath, oldTitle+".md")). An attacker can supply a path traversal sequence such as ../../../../tmp/target_file as the old_title value in a POST request to /repo/wiki/edit, causing the server to delete files outside the wiki directory. The deletion is nominally constrained to files ending in .md, though the advisory notes this restriction may be bypassed in certain contexts (GitHub Advisory). A public proof-of-concept exploit is available (PoC).

Successful exploitation allows an authenticated attacker to delete arbitrary files on the Gogs server, resulting in data loss and potential denial of service. Critical .md files such as documentation, other users' wiki pages, or configuration files could be permanently removed, disrupting service availability and integrity. While confidentiality is not directly impacted (no data is read or exfiltrated), the ability to delete files could destabilize the Gogs instance or supporting infrastructure, potentially affecting all users and repositories hosted on the server (Gogs Security Advisory, GitHub Advisory).

A public proof-of-concept exploit is available on GitHub (PoC), published on March 2, 2026. As of the time of reporting, there is no confirmed evidence of in-the-wild exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.037–0.074%, placing it in the lower percentiles for near-term exploitation probability. Exploitation requires an authenticated account with wiki write access, limiting the attacker pool but not eliminating risk in multi-tenant or open-registration Gogs instances (GitHub Advisory, Feedly).

1. Reconnaissance: Identify Gogs instances running version 0.13.3 or earlier using Shodan, Censys, or similar tools by searching for Gogs-specific HTTP headers or login pages.
2. Obtain wiki write access: Register or log in to the target Gogs instance with an account that has write access to at least one repository's wiki (this may be a low-privilege user account).
3. Navigate to wiki edit: Open any existing wiki page in the target repository and initiate an edit to trigger the wiki update form.
4. Intercept the POST request: Use a proxy tool such as Burp Suite to intercept the POST request sent to /[user]/[repo]/wiki/edit.
5. Inject path traversal payload: Modify the old_title parameter in the intercepted request to a path traversal sequence targeting the desired file, e.g., old_title=../../../../tmp/target_file (the server will append .md to the filename).
6. Submit the request: Forward the modified request to the server. The os.Remove call in internal/database/wiki.go will resolve the traversed path and delete the target file (e.g., /tmp/target_file.md).
7. Verify deletion: Confirm the file has been deleted by checking for its absence or observing resulting service disruption (Gogs Security Advisory, PoC).

• Network: Unusual POST requests to /<user>/<repo>/wiki/edit endpoints containing path traversal sequences (e.g., ../, %2e%2e%2f) in the old_title parameter; repeated wiki edit requests from the same authenticated user in a short timeframe.
• Logs: Gogs application logs showing wiki page update operations with old_title values containing directory traversal patterns; file system audit logs (e.g., auditd) recording unexpected unlink/remove calls on .md files outside the wiki directory.
• File System: Unexpected deletion of .md files in directories outside the Gogs wiki storage path; missing documentation or configuration files with .md extensions that were previously present.
• Process: Gogs process performing file deletion operations (os.Remove) on paths outside the expected wiki local directory (Gogs Security Advisory).

Upgrade Gogs to version 0.13.4 or 0.14.0+dev, which sanitize the old_title parameter using ToWikiPageName before passing it to file system operations (Gogs Security Advisory). For organizations unable to patch immediately, restrict wiki write access to only fully trusted users and implement file system monitoring to detect unauthorized .md file deletions. Additionally, consider applying network-level access controls to limit who can interact with the Gogs instance, and audit current wiki write permissions across all repositories.

Security media outlets including SecurityOnline.info, CyberPress, and UnderCodeNews covered the vulnerability in the context of a broader set of critical Gogs flaws, with some headlines referencing RCE and 2FA bypass issues alongside CVE-2026-24135 (SecurityOnline, CyberPress). The researcher credited with discovery, reschjonas, published a PoC on GitHub shortly after disclosure. FortiGuard also referenced the vulnerability in IPS update notes, indicating vendor security tooling has begun incorporating detection (FortiGuard).