Gogs: Overwriting critical files results in a denial of service

Vulnerability

The vulnerability resides in the DiffPreviewPost handler in Gogs (internal/route/repo/editor.go). When an authorized user sends a POST request to /:user/:repo/_preview/:branch/:path_to_file, the treePath parameter is taken directly from the URL without sanitization. This value is then passed to GetDiffPreview, which writes the diff output to a path derived from treePath. By supplying a path traversal sequence (e.g., ../), an attacker can bypass the intended repository directory and write the diff result to an arbitrary location on the filesystem. Affected versions are those prior to the fix (commit b7372b1f32cd0bb40984debfb049e3fc04efaee4). [1][2]

Exploitation

An attacker must be an authorized user of the Gogs instance (i.e., have an account and be logged in). The attacker crafts a POST request to the preview endpoint with a :path_to_file value that includes path traversal components (e.g., ../../etc/passwd). The TreeEntry check is bypassed because the attacker can point to an existing file in the repository that matches the traversal path (e.g., by using a symlink or by ensuring the path resolves to an existing file). The GetDiffPreview function then writes the diff output to the attacker-controlled path, overwriting the target file. [1][2]

Impact

Successful exploitation allows an authorized user to overwrite arbitrary files on the server filesystem, leading to a denial of service (DoS). The attacker can overwrite critical system or application files, potentially causing the Gogs service to crash or become unavailable. No code execution or data disclosure is reported; the impact is limited to DoS. [1][2]

Mitigation

The fix is available in the Gogs repository at commit b7372b1f32cd0bb40984debfb049e3fc04efaee4. The recommended change is to replace the direct use of treePath with the sanitized entry variable and to use the pathutil.Clean function instead of path.Clean from the standard library. Users should update to a version that includes this commit or apply the patch manually. No workaround is provided. [1][2]