What is GHSA-phm4-wf3h-pc3r?

GHSA-phm4-wf3h-pc3r is a security advisory published by GitHub Security Advisories with High severity. Remote Code Execution in Gogs

Which CVE IDs does GHSA-phm4-wf3h-pc3r cover?

GHSA-phm4-wf3h-pc3r covers the following CVE IDs: CVE-2024-44625. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-phm4-wf3h-pc3r?

GHSA-phm4-wf3h-pc3r has a CVSS v3 base score of 8.8, published by GitHub Security Advisories.

Which products are affected by GHSA-phm4-wf3h-pc3r?

GHSA-phm4-wf3h-pc3r affects 1 product, including: go/gogs.io/gogs:\u003c 0.13.2.

GHSA-phm4-wf3h-pc3rHighCVSS 8.8

Remote Code Execution in Gogs

Vendor

GitHub Security Advisories

Published

November 15, 2024

Last Modified

October 8, 2025

🔗 CVE IDs covered (1)

CVE-2024-44625 →

📋 Description

Gogs <0.13.2 is vulnerable to symbolic link path traversal that enables remote code execution via the editFilePost function of internal/route/repo/editor.go.

🎯 Affected products1

go/gogs.io/gogs:< 0.13.2

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2024-44625
https://fysac.github.io/posts/2024/11/unpatched-remote-code-execution-in-gogs
https://pkg.go.dev/vuln/GO-2024-3275
https://gogs.io
https://github.com/advisories/GHSA-phm4-wf3h-pc3r