github.com/gogs/gogs v0.14.3

Why

• warnVulnerability

  github.com/gogs/gogs affected by CVE-2024-39930

• warnLikely exploited

  Gogs allows deletion of internal files in github.com/gogs/gogs EPSS puts the chance of exploitation in the next 30 days at 53% (higher than 99% of all scored vulnerabilities). That is a forecast, not an observation, so it raises this finding rather than blocking it.

• warnLikely exploited

  Gogs allows argument injection during the previewing of changes in github.com/gogs/gogs EPSS puts the chance of exploitation in the next 30 days at 16% (higher than 97% of all scored vulnerabilities). That is a forecast, not an observation, so it raises this finding rather than blocking it.

• warnVulnerability

  Gogs allows argument injection during the tagging of a new release in github.com/gogs/gogs

What the code does

On its own this is weak signal: plenty of honest libraries read files or talk to the network. What PkgFire watches is a release gaining something the one before it did not.