CISA ORDERS FEDS TO PATCH GOGS RCE FLAW EXPLOITED IN 0-DAY ATTACKS

Summary from the TLDR InfoSec newsletter

CISA has ordered government agencies to secure their systems against a high-severity vulnerability in the Gogs alternative for GitHub. The remote code execution (RCE) vulnerability is caused by a path traversal weakness in the PutContents API that allows attackers to bypass protections implemented for a previous RCE bug. Attackers can exploit the vulnerability by creating symbolic links that point to system files and then using the PutContents API to write data to those files via the symbolic links.