{"schema_version":"1.7.3","id":"GHSA-jp7c-wj6q-3qf2","published":"2026-02-06T18:16:25Z","modified":"2026-02-19T20:40:59.281691Z","aliases":["CVE-2026-24135","GO-2026-4452"],"summary":"Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update","details":"### Summary\nA Path Traversal vulnerability exists in the `updateWikiPage` function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulating the `old_title` parameter in the wiki editing form.\n\n### Vulnerability Deatils\nThe vulnerability is located in `internal/database/wiki.go`. When updating a wiki page, the application accepts an `old_title` parameter to identify the potential rename operation. This parameter is used directly in `path.Join` and `os.Remove` without proper sanitization.\n\nCode snippet from `internal/database/wiki.go`:\n```go\n// Line 114\nos.Remove(path.Join(localPath, oldTitle+\".md\"))\n```\n\nIf an attacker provides a path traversal sequence (e.g., `../../../../target`) as `old_title`, the `os.Remove` function will resolve the path relative to the wiki's local directory and delete the target file. The vulnerability is limited to deleting files that end with `.md` (due to the appended extension), but depending on the filesystem and specific `path.Join` behavior, or if critical `.md` files exist (e.g. documentation, other wikis), the impact is significant. Additionally, in some contexts, the extension might be bypassed or ignored.\n\n### Impact\n- **Denial of Service**: Deletion of critical configuration files or data (if they match the extension or via other tricks).\n- **Data Loss**: Deletion of other users' wiki pages or documentation.\n\n### Remediation\nSanitize the `oldTitle` parameter using `ToWikiPageName` (or `path.Clean` and basename validation) before using it in file operations, similar to how the new `title` is currently handled.\n\n```go\n// Recommended Fix\nif oldTitle != \"\" {\n    oldTitle = ToWikiPageName(oldTitle)\n}\n```\n\n### Reproduction Steps\n1.  Log in to Gogs as a user with write access to a repository wiki.\n2.  Intercept the `POST` request to `/repo/wiki/edit`.\n3.  Modify the `old_title` parameter to `../../../../tmp/target_file`.\n4.  Submit the request.\n5.  Observe that `/tmp/target_file.md` is deleted from the server.","affected":[{"package":{"name":"gogs.io/gogs","ecosystem":"Go","purl":"pkg:golang/gogs.io/gogs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.13.4"}]}],"database_specific":{"last_known_affected_version_range":"<= 0.13.3","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-jp7c-wj6q-3qf2/GHSA-jp7c-wj6q-3qf2.json"}}],"references":[{"type":"WEB","url":"https://github.com/gogs/gogs/security/advisories/GHSA-jp7c-wj6q-3qf2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-24135"},{"type":"PACKAGE","url":"https://github.com/gogs/gogs"}],"database_specific":{"cwe_ids":["CWE-22"],"github_reviewed":true,"github_reviewed_at":"2026-02-06T18:16:25Z","nvd_published_at":"2026-02-06T18:15:57Z","severity":"HIGH"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N"}]}