Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update
Date: 2026-02
Affected: go/gogs.io/gogs
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-24135
CWE: CWE-22

### Summary A Path Traversal vulnerability exists in the `updateWikiPage` function of Gogs. The vulnerability allows an authenticated user with write access to a repository's wiki to delete arbitrary files on the server by manipulating the `old_title` parameter in the wiki editing form. ### Vulnerability Deatils The vulnerability is located in `internal/database/wiki.go`. When updating a wiki page, the application accepts an `old_title` parameter to identify the potential rename operation. This parameter is used directly in `path.Join` and `os.Remove` without proper sanitization. Code snippet from `internal/database/wiki.go`: ```go // Line 114 os.Remove(path.Join(localPath, oldTitle+".md")) ``` If an attacker provides a path traversal sequence (e.g., `../../../../target`) as `old_title`, the `os.Remove` function will resolve the path relative to the wiki's local directory and delete the target file. The vulnerability is limited to deleting files that end with `.md` (due to the appended extension), but depending on the filesystem and specific `path.Join` behavior, or if critical `.md` files exist (e.g. documentation, other wikis), the impact is significant. Additionally, in some contexts, the extension might be bypassed or ignored. ### Impact - **Denial of Service**: Deletion of critical configuration files or data (if they match the extension or via other tricks). - **Data Loss**: Deletion of other users' wiki pages or documentation. ### Remediation Sanitize the `oldTitl


Mitigations:

Architectural layers (MAESTRO):