CVE-2024-39932: Gogs argument-injection flaws in change preview and release tagging
The short version: Gogs — the lightweight self-hosted Git service — has a pair of argument-injection flaws disclosed together: CVE-2024-39932 (during previewing of changes) and CVE-2024-39933 (during the tagging of a new release). An authenticated user can inject extra Git arguments into server-side commands, and the more serious of the two reaches remote code execution. If you self-host Gogs, upgrade and reduce your auth bar.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — post-authentication injection, one path to RCE |
| CVSS v3.1 (NVD) — CVE-2024-39932 | 9.9 — Critical · AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (CWE-94) |
| CVSS v3.1 (NVD) — CVE-2024-39933 | 7.7 — High · AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N (CWE-88) |
| EPSS | CVE-2024-39932 ~17.18% · 96th pct · CVE-2024-39933 ~0.69% · 48th pct (2026-07-17) |
| In CISA KEV? | No (neither) |
| Known exploited? | Not confirmed in the wild |
| Vulnerability type | Argument injection (CWE-94 / CWE-88) → code execution / restricted file read |
| Requires authenticated session? | Yes — an authenticated user |
| Affected | Gogs through 0.13.0 |
| Fixed in | Unknown at time of writing — see the Gogs release notes; the disclosing researchers reported incomplete fixes at publication |
What you need to know
Both flaws come from the same class of problem: user-controlled input reaches a Git command line without proper neutralization, so an authenticated attacker can inject additional arguments that change what the command does.
- CVE-2024-39932 — previewing of changes. The higher-impact of the two, scored 9.9 (CWE-94, code injection). Injected arguments during a change preview can lead to code execution on the server.
- CVE-2024-39933 — tagging a new release. Scored 7.7 (CWE-88, argument injection). Injection during release tagging can coerce Git into reading a restricted file and returning its contents.
Two things shape the practical risk. First, both require an authenticated account — but Gogs instances that allow self-registration make that a low bar. Second, at disclosure the researchers reported that Gogs' fixes were incomplete, so pinning an exact "fixed in" version needs a check against the current release notes rather than a guess.
How serious we see it
High.
CVE-2024-39932 carries a Critical base score because it can reach code execution and needs only low privileges; CVE-2024-39933 is a High-severity restricted-file read. We rate the pair High in practice: exploitation requires an authenticated session, which narrows the population — but where self-registration is enabled, treat it as close to unauthenticated. The honest caveat is the fix uncertainty; the reassuring part is that reducing your auth bar and staying current on releases meaningfully shrinks the risk.
Recommendations
- Update to the latest Gogs release and confirm the fix. Because the disclosed fixes were reported incomplete, check the Gogs release notes for the versions that address CVE-2024-39932 and CVE-2024-39933 before assuming you're covered.
- Reduce the auth bar. Disable open self-registration on internet-facing instances.
- Restrict exposure. Limit who can reach the Gogs instance from the internet.
- Confirm your exposure first. Verify whether you run an internet-facing Gogs and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing Gogs instances in your external footprint, fingerprints the version, and flags exposure tied to these CVEs. Because both flaws require an authenticated session, they aren't something we safely exploit — we detect and flag the affected version so it's on your radar with the right context.
That outside-in view means a self-hosted Git server is mapped and version-checked, so flaws like these surface as specific findings rather than blind spots.