Path traversal in gogs - #VU133268

Detailed vulnerability description

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to path traversal in the POST /:user/:repo/_preview/:branch/:path_to_file endpoint when processing a user-controlled path passed to the git diff command. A remote user can supply a crafted path using the --output option to overwrite critical files and cause a denial of service.

The issue requires an authorized user account and can be used to overwrite files such as the database or configuration file.

Remediation

Sources

• https://github.com/gogs/gogs/security/advisories/GHSA-pm6v-2h4w-4rp2
• https://github.com/gogs/gogs/blob/b7372b1f32cd0bb40984debfb049e3fc04efaee4/internal/route/repo/editor.go#L307