This critical path traversal vulnerability in Gogs allows authenticated attackers to achieve remote code execution and is currently being actively exploited in the wild.

The vulnerability exists due to improper symbolic link handling within the PutContents API, which allows an authenticated user to perform path traversal. This flaw enables attackers to overwrite system files, ultimately leading to remote code execution.

The severity of this vulnerability is critical, reflected by a CVSS score of 9.5. Successful exploitation provides an attacker with the ability to execute arbitrary code on the host system, potentially leading to a complete compromise of the Gogs server, unauthorized access to sensitive source code, and loss of intellectual property. The active exploitation of this flaw by threat actors, including the deployment of the Supershell malware, poses a significant risk to organizational security and operational integrity.

Immediate Action: Update Gogs to version 0.13.4 or higher immediately to apply the vendor-provided security patch.

Proactive Monitoring: Review web server and application logs for suspicious entries related to the PutContents API or unexpected file modification attempts.

Compensating Controls: Ensure that the Gogs instance is not exposed to the public internet without an authentication layer or a properly configured Web Application Firewall (WAF) capable of detecting path traversal patterns.

Public Exploit Available: Yes, multiple public proofs-of-concept are available on GitHub.

Given the critical CVSS severity and confirmed active exploitation in the wild, immediate action is required to secure affected environments. Organizations must prioritize updating to version 0.13.4 and auditing their Gogs instances for signs of compromise. Failure to remediate this vulnerability exposes the organization to severe risks, including full system takeover and data exfiltration.