UNPATCHED REMOTE CODE EXECUTION IN GOGS

Summary from the TLDR InfoSec newsletter

The Gogs self-hosted Git service version 0.13.0 has a vulnerability (CVE-2024-44625) that allows remote code execution. Attackers can exploit this by gaining access to an account that can push to a repository and editing files from the web interface. The issue remains unaddressed by Gogs developers despite multiple reports, prompting users to take security measures and consider migrating to Gitea.