OS Command Injection in gogs - CVE-2022-2024
Published: February 25, 2023 / Updated: April 27, 2026
Vulnerability identifier: #VU128080
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2022-2024
CWE-ID: CWE-78
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
gogs
gogs
Software vendor:
gogs.io
gogs.io
Description
The vulnerability allows a remote user to gain SSH access to the server.
The vulnerability exists due to improper neutralization of special elements used in an os command in the repo editor upload path handling for the repository's .git directory when processing crafted repository uploads and file deletions on case-insensitive file systems. A remote user can upload a crafted config file and trigger crafted file deletion to gain SSH access to the server.
Only installations with repository upload enabled on case-insensitive file systems are vulnerable.
Remediation
Install security update from vendor's website.