10000 OS Command Injection in file uploading · Issue #6968 · gogs/gogs · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

OS Command Injection in file uploading #6968

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
1 task done
unknwon opened this issue May 25, 2022 · 1 comment · Fixed by #6970
Closed
1 task done

OS Command Injection in file uploading #6968

unknwon opened this issue May 25, 2022 · 1 comment · Fixed by #6970
Assignees
@unknwon
Labels
💊 bug Something isn't working 🔒 security Categorizes as related to security
Milestone
0.12.8

Comments

@unknwon
Copy link
Member
unknwon commented May 25, 2022

Describe the bug

The report on huntr.dev https://www.huntr.dev/bounties/9cd4e7b7-0979-4e5e-9a1c-388b58dea76b/

Code of Conduct

  • I agree to follow this project's Code of Conduct
@unknwon unknwon added 💊 bug Something isn't working 🔒 security Categorizes as related to security labels May 25, 2022
@unknwon unknwon added this to the 0.13.0 milestone May 25, 2022
@unknwon unknwon moved this to Todo in Gogs Roadmap May 25, 2022
1135 added a commit to 1135/gogs that referenced this issue May 26, 2022
@1135
repo_editor: check path
efbdafe 
Link to the issue: gogs#6968
@unknwon unknwon linked a pull request May 26, 2022 that will close this issue
repo_editor: prohibits uploading files to .git. directory #6970
Merged
3 tasks
@unknwon unknwon modified the milestones: 0.13.0, 0.12.8 May 26, 2022
@unknwon unknwon moved this from Todo to In Progress in Gogs Roadmap May 26, 2022
@unknwon unknwon self-assigned this May 30, 2022
Repository owner moved this from In Progress to Done in Gogs Roadmap May 30, 2022
@unknwon
Copy link
Member Author
unknwon commented May 31, 2022

The 0.12.8 has been released that includes the patch of the reported issue.

The security Advisory has been published at GHSA-958j-443g-7mm7.

@github-actions github-actions bot locked as resolved and limited conversation to collaborators Aug 30, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@unknwon unknwon

Labels
💊 bug Something isn't working 🔒 security Categorizes as related to security
Projects
No open projects
Gogs Roadmap
Status: Done
Milestone
0.12.8
Development

Successfully merging a pull request may close this issue.

repo_editor: prohibits uploading files to .git. directory 1135/gogs
1 participant
@unknwon
0