Vulnerability · Published Feb 6, 2026 · Assigned by GitHub_M

CVE-2026-24135Gogs vulnerable to arbitrary file deletion via path traversal in wiki page update

High 7.2

In plain English

A high-severity path traversal in gogs from gogs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.2High

Exploit odds (30 days)1.0%top 38.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling1Public PoC

Official description

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulating the old_title parameter in the wiki editing form. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	gogs.io/gogs	0.13.4	GHSA-jp7c-wj6q-3qf2
Go	gogs.io/gogs	no fix listed	GO-2026-4452

Affected products (as reported)

Vendor	Product	Versions
gogs	gogs	< 0.14.0+dev< 0.13.4

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/gogs/gogs/security/advisories/GHSA-jp7c-wj6q-3qf2 x_refsource_CONFIRM