What is GHSA-994f-7g86-qr56?

GHSA-994f-7g86-qr56 is a security advisory published by GitHub Security Advisories with Critical severity. Path Traversal in file editor on Windows in Gogs

Which CVE IDs does GHSA-994f-7g86-qr56 cover?

GHSA-994f-7g86-qr56 covers the following CVE IDs: CVE-2022-1992. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-994f-7g86-qr56?

GHSA-994f-7g86-qr56 has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-994f-7g86-qr56?

GHSA-994f-7g86-qr56 affects 1 product, including: go/gogs.io/gogs:\u003c 0.12.9.

GHSA-994f-7g86-qr56CriticalCVSS 9.1

Path Traversal in file editor on Windows in Gogs

Vendor

GitHub Security Advisories

Published

June 8, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2022-1992 →

📋 Description

Impact

The malicious user is able to delete and upload arbitrary file(s). All installations on Windows with repository upload enabled (default) are affected.

Patches

Path cleaning has accommodated for Windows. Users should upgrade to 0.12.9 or the latest 0.13.0+dev.

Workarounds

N/A

References

https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab/

For more information

If you have any questions or comments about this advisory, please post on #7001.

🎯 Affected products1

go/gogs.io/gogs:< 0.12.9

🔗 References (7)

https://github.com/gogs/gogs/security/advisories/GHSA-994f-7g86-qr56
https://github.com/gogs/gogs/commit/2ca014250fbf0bba94c914d9e43b1f6d8eca3bb0
https://github.com/gogs/gogs/blob/f36eeedbf89328ee70cc3a2e239f6314f9021f58/conf/app.ini#L127-L129
https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab/
https://nvd.nist.gov/vuln/detail/CVE-2022-1992
https://huntr.dev/bounties/2e8cdc57-a9cf-46ae-9088-87f09e6c90ab
https://github.com/advisories/GHSA-994f-7g86-qr56