Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulating the old_title parameter in the wiki editing form. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

Gogs <= 0.13.3 Multiple Vulnerabilities

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal
    vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated
    user with write access to a repository's wiki to delete arbitrary files on the server by manipulating the
    old_title parameter in the wiki editing form. This issue has been patched in versions 0.13.4 and
    0.14.0+dev. (CVE-2026-24135)

According to its self-reported version, the instance of Gogs running on the remote host is prior or equal to 0.13.3.
It is, therefore, affected by multiple vulnerabilities, including:

  - Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code. (CVE-2025-8110)

  - Due to the insufficient patch for CVE-2024-56731, it is still possible to update files in the .git directory and     achieve remote command execution. (CVE-2025-64111)

  - An arbitrary file read/write via path traversal exists in Git hook editing. (CVE-2026-23633)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
437606	SCA: security update for gogs.io/gogs (GHSA-jp7c-wj6q-3qf2)	Tenable Cloud Security	SCA Checks	high
437606	SCA: security update for gogs.io/gogs (GHSA-jp7c-wj6q-3qf2)	Tenable Self-Hosted Container Security	SCA Checks	high
286268	Gogs <= 0.13.3 Multiple Vulnerabilities	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-24135

high

Tenable Plugins

Coming Soon

high

high

critical