CVE-2024-56731 is a critical severity flaw (CVSS 10.0) in Gogs, the self hosted Git service. In versions through 0.13.2, an insufficient fix for CVE-2024-39931 still lets a user delete files in the .git directory and reach remote command execution. Upgrade to 0.13.3.
What's affected
The Gogs advisory GHSA-wj44-9vcg-wjq7 lists the Go module gogs.io/gogs with affected versions up to and including 0.13.2. The advisory page shows no patched version in its structured field, but the 0.13.3 release notes list this exact advisory under Fixed security items, and the NVD record says it was patched in 0.13.3. Upgrade to 0.13.3 or later.
Release 0.13.3 also fixes a second advisory, a stored cross-site scripting issue in the PDF renderer. Earlier 0.13.2 release notes list a long run of security fixes, including path traversal and argument injection, which is a good reason not to sit on old Gogs versions.
The impact in the advisory is execution of arbitrary commands with the privileges of the account set as RUN_USER, which means access to and modification of every user's repositories on the instance.
How to check if you're exposed
Check the Gogs version in the page footer, or from the command line on the server:
gogs --version
For containers, look at the image tag. Anything at 0.13.2 or earlier is affected.
Then review who can register accounts and create or edit repository files. The vector in the record shows no privileges required, so open registration changes the picture. Check the configuration for the registration setting:
grep -n "DISABLE_REGISTRATION" custom/conf/app.ini
Finally, look at the account behind RUN_USER. If it is a normal login account with access to other data, an attacker who gets command execution gains all of that too.
What to do now
- Upgrade every Gogs instance to 0.13.3 or later.
- Disable open registration if you do not need it, and review the existing accounts for ones you do not recognize.
- Run Gogs under a dedicated low privilege account with no access beyond its own data directories.
- Do not expose the instance to the internet unless you must. Put it behind a VPN or an authenticating proxy.
- Inspect repositories for unexpected changes to Git hooks and look in each .git directory for files you did not put there.
- Take a backup before the upgrade and keep it offline, since the advisory describes the ability to alter any user's code.
Why it matters
The record maps this to CWE-552, files or directories accessible to external parties. The advisory gives the story in short form. After CVE-2024-39931, the project added a check that refused changes to a path inside the .git directory. But the check looked at the path name, and nothing checked for symbolic links afterward. Make a link that points into .git, and the path name looks harmless while the operation lands in the protected place.
Why does touching .git lead to commands? Git hooks are scripts that Git runs when certain actions happen. Altering what lives in .git can change what the server executes. That is the chain the advisory points to. It is also a common pattern: a patch blocks the exact input from the original report, and a variation gets around it. The sensible response is to take the whole run of security releases for the project. The KEV flag in the record is false.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which version fixes CVE-2024-56731?
Gogs 0.13.3, listed in the release notes under fixed security items.
Why does the advisory say no patched version?
The structured field on the advisory page is empty, but the 0.13.3 release notes name this advisory. Treat 0.13.3 as the fix and verify on the release page.
Sources
Last reviewed: 19 October 2026.
