CVE-2024-55947

CVE-2024-55947 is a path traversal flaw (CWE-22) in Gogs, an open source self-hosted Git service, that allows a malicious user to write a file to an arbitrary path on the server. It requires only low privileges, so any authenticated Gogs user can trigger it over the network without user interaction, and by planting a file in a sensitive location — such as the service account's SSH authorized_keys — the attacker gains SSH access to the host, effectively compromising the server (high confidentiality, integrity, and availability impact per CVSS). All Gogs deployments running versions prior to 0.13.1 are affected. Exploitation is no longer theoretical: recent reporting describes active attacks hitting 700+ instances, and CISA has flagged the flaw as actively exploited, adding it to its Known Exploited Vulnerabilities catalog. EPSS assigns a 75.2% probability of exploitation within 30 days (99th percentile), underscoring elevated risk for exposed instances.

What to do: Upgrade all Gogs instances to 0.13.1 or later, which fixes this flaw, and treat the upgrade as urgent given active exploitation and the KEV listing. Check your deployed version, audit the host for rogue SSH keys and unexpected file writes (especially the git service account's authorized_keys), and review account activity and logs for signs of compromise. Until patched, limit network exposure of the Gogs service and the server's SSH port, and restrict account creation to trusted users.