-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| gogs.io/gogs | go | < 0.12.8 | 0.12.8 |
GoGoMiggo AIRoot Cause AnalysisThe vulnerability stems from insufficient path validation in file upload handling. The patch in PR #6970 specifically modifies repo_editor.go to add .git directory checks, indicating this was the vulnerable component. The CVE description explicitly mentions .git/config manipulation through unauthorized uploads, which aligns with the function's responsibility for processing repository file uploads. The Windows-specific SSH command injection occurs when attackers modify core.sshCommand in .git/config, which this function's lack of path filtering enabled.
Ongoing coverage of React2Shell