LiveActive security incident?Get immediate response
CVE Record

CVE-2021-32546: Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute...

Missing input validation in internal/db/repo_editor.go in Gogs before 0.12.8 allows an attacker to execute code remotely. An unprivileged attacker (registered user) can overwrite the Git configuration in his repository. This leads to Remote Command Execution, because that configuration can contain an option such as sshCommand, which is executed when a master branch is a remote branch (using an ssh:// URI). The remote branch can also be configured by editing the Git configuration file. One can create a new file in a new repository, using the GUI, with "\" as its name, and then rename this file to .git/config with the custom configuration content (and then save it).

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

Gogs versions before 0.12.8 let a registered, low-privilege user overwrite Git configuration inside their repository. That configuration can cause the server to execute commands during Git operations. The issue is serious for any exposed Gogs service that allows self-registration or untrusted users.

Executive priority

Treat this as high priority for any internet-facing or multi-tenant Gogs instance. The issue can turn ordinary registered-user access into server code execution, but the provided sources do not establish mass exploitation.

Technical view

The flaw is missing input validation in internal/db/repo_editor.go. A registered user can manipulate repository file paths to write .git/config, set Git options such as sshCommand, and configure a remote master branch using an ssh:// URI, resulting in remote command execution.

Likely exposure

Exposure is limited to Gogs deployments before 0.12.8. Risk is higher where external or low-trust users can register, create repositories, and use the web GUI to edit repository files.

Exploitation context

The source bundle describes a GUI-based path/config overwrite leading to command execution. It requires a registered user account. The CVE is not listed as KEV in the provided data, and no cited source here confirms active exploitation.

Researcher notes

The public description gives the affected component, prerequisite account level, and high-level exploit path. It does not provide CVSS, CWE, CPEs, or evidence of exploitation in the supplied bundle.

Mitigation direction

  • Upgrade affected Gogs deployments to 0.12.8 or later.
  • Review the Gogs advisory and release notes before rollout.
  • Restrict untrusted user registration until affected instances are upgraded.
  • Preserve repository data for investigation if compromise is suspected.

Validation and detection

  • Inventory Gogs instances and confirm exact running versions.
  • Check whether self-registration or untrusted repository creation is enabled.
  • Review repositories for unexpected .git/config changes or suspicious remote settings.
  • Confirm upgraded instances no longer run versions before 0.12.8.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-32546 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.