https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 07:25:01 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-267562 EUVD-2026-267562 https://cve.radiocsirt.org/vuln/euvd-2026-267562 https://cve.radiocsirt.org/vuln/fkie_cve-2026-24135 <p>Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository&#39;s wiki to delete arbitrary files on the server by manipulating the old_title parameter in the wiki editing form. This issue has been patched in versions 0.13.4 and 0.14.0+dev.</p> <p>Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, a path traversal vulnerability exists in the updateWikiPage function of Gogs. The vulnerability allows an authenticated user with write access to a repository&#39;s wiki to delete arbitrary files on the server by manipulating the old_title parameter in the wiki editing form. This issue has been patched in versions 0.13.4 and 0.14.0+dev.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-24135 https://cve.radiocsirt.org/vuln/ghsa-jp7c-wj6q-3qf2 <p><strong>Affected:</strong> Go: gogs.io/gogs</p> <p>### Summary A Path Traversal vulnerability exists in the `updateWikiPage` function of Gogs. The vulnerability allows an authenticated user with write access to a repository&#39;s wiki to delete arbitrary files on the server by manipulating the `old_title` parameter in the wiki editing form.</p> <p>### Vulnerability Deatils The vulnerability is located in `internal/database/wiki.go`. When updating a wiki page, the application accepts an `old_title` parameter to identify the potential rename operation. This parameter is used directly in `path.Join` and `os.Remove` without proper sanitization.</p> <p>Code snippet from `internal/database/wiki.go`: ```go // Line 114 os.Remove(path.Join(localPath, oldTitle+&#34;.md&#34;)) ```</p> <p>If an attacker provides a path traversal sequence (e.g., `../../../../target`) as `old_title`, the `os.Remove` function will resolve the path relative to the wiki&#39;s local directory and delete the target file. The vulnerability is limited to deleting files that end with `.md` (due to the appended extension), but depending on the filesystem and specific `path.Join` behavior, or if critical `.md` files exist (e.g. documentation, other wikis), the impact is significant. Additionally, in some contexts, the extension might be bypassed or ignored.</p> <p>### Impact - **Denial of Service**: Deletion of critical configuration files or data (if they match the extension or via other tricks). - **Data Loss**: Deletion of other users&#39; wiki pages or documentation.</p> <p>### Remediation Sanitize the `oldTit…</p> <p><strong>Affected:</strong> Go: gogs.io/gogs</p> <p>### Summary A Path Traversal vulnerability exists in the `updateWikiPage` function of Gogs. The vulnerability allows an authenticated user with write access to a repository&#39;s wiki to delete arbitrary files on the server by manipulating the `old_title` parameter in the wiki editing form.</p> <p>### Vulnerability Deatils The vulnerability is located in `internal/database/wiki.go`. When updating a wiki page, the application accepts an `old_title` parameter to identify the potential rename operation. This parameter is used directly in `path.Join` and `os.Remove` without proper sanitization.</p> <p>Code snippet from `internal/database/wiki.go`: ```go // Line 114 os.Remove(path.Join(localPath, oldTitle+&#34;.md&#34;)) ```</p> <p>If an attacker provides a path traversal sequence (e.g., `../../../../target`) as `old_title`, the `os.Remove` function will resolve the path relative to the wiki&#39;s local directory and delete the target file. The vulnerability is limited to deleting files that end with `.md` (due to the appended extension), but depending on the filesystem and specific `path.Join` behavior, or if critical `.md` files exist (e.g. documentation, other wikis), the impact is significant. Additionally, in some contexts, the extension might be bypassed or ignored.</p> <p>### Impact - **Denial of Service**: Deletion of critical configuration files or data (if they match the extension or via other tricks). - **Data Loss**: Deletion of other users&#39; wiki pages or documentation.</p> <p>### Remediation Sanitize the `oldTit…</p> https://cve.radiocsirt.org/vuln/ghsa-jp7c-wj6q-3qf2 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0338 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0338