Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

Affected: Go: gogs.io/gogs

## Vulnerability Description

In the endpoint:

``` /username/reponame/settings/hooks/git/:name ```

the `:name` parameter:

* Is URL-decoded by **macaron routing**, allowing decoded slashes (`/`) * Is then passed directly to:

```go git.Repository.Hook("custom_hooks", name) ```

which internally resolves the path as:

```go filepath.Join(repoPath, "custom_hooks", name) ```

Because no path sanitization is applied, supplying `../` sequences allows access to **arbitrary paths outside the repository**.

### As a Result:

* **GET:** Arbitrary file contents are displayed in the hook edit page textarea (**Local File Inclusion**). * **POST:** Existing files can be overwritten with attacker-controlled content (**Arbitrary File Write**).

---

## Attack Prerequisites

* The attacker is an authenticated user * The attacker has **Admin or higher privileges** on the target repository * The attacker has the **AllowGitHook** permission (or is a site administrator) * The target file is readable/writable by the **Gogs process OS permissions**

---

## Attack Scenario

1. An attacker (with AllowGitHook + repository Admin privileges) accesses the Git hook edit URL 2. A path containing `../` is supplied in `:name`, fully URL-encoded using `%2f` 3. The server resolves `custom_hooks/../../...` without validation 4. Arbitrary file contents are displayed and existing files can be overwritten

---

## Potential Impact

* **Sensitive information disclosure:** `app.ini`, databases, logs, environment…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.