CVE-2024-44625: Directory Traversal via the editFilePost
function of internal/route/repo/editor.go.
CVE-2024-39933: Gogs allows argument injection during the
tagging of a new release.
CVE-2024-39932: Gogs allows argument injection during the
previewing of changes.
CVE-2024-39931: Gogs allows deletion of internal files.
CVE-2024-39930: The built-in SSH server of Gogs allows
argument injection in internal/ssh/ssh.go, leading to remote
code execution. Authenticated attackers can exploit this by
opening an SSH connection and sending a malicious
--split-string env request if the built-in SSH server is
activated.