CVE-2024-55947

CVE-2024-55947 is a critical arbitrary file write vulnerability affecting Gogs, an open-source self-hosted Git service. A malicious authenticated user can exploit this flaw to write files to arbitrary server paths, leading to SSH access and full system compromise. With a CVSS score of 8.8 (HIGH) and an EPSS score indicating high exploitability, this vulnerability poses a significant risk due to its low attack complexity and severe impact on confidentiality, integrity, and availability. This zero-day vulnerability is actively exploited in the wild, with multiple media outlets reporting its use to compromise hundreds of servers, despite the absence of public exploit code or a patch at the time of initial exploitation.