【高危】gogs 安全更新（GHSA-p9f5-h3rx-j5qw）

安全情报快照 · 风险级别：高危 · CVSS：7.5 · CVE-2026-52799 · GHSA-p9f5-h3rx-j5qw

先看结论

gogs存在安全风险，<= 0.14.2 受影响，建议升级至 0.14.3。

影响范围

生态	组件	受影响版本	首个修复版本
go	`gogs.io/gogs`	<= 0.14.2	0.14.3

处置建议

优先将 gogs.io/gogs 升级至 0.14.3 或更高版本；升级前请结合业务依赖完成兼容性验证。

上游技术详情（原文）

Summary

In Gogs 0.14.1, GET /attachments/:uuid returns the raw attachment file without verifying whether the requester has view permission for the associated Issue/Comment/Release or the repository.
In a test environment with REQUIRE_SIGNIN_VIEW = false, we confirmed that an unauthenticated user can download attachments belonging to a private repository.

Description

/attachments/:uuid retrieves an attachment record solely by the UUID provided in the URL and returns the corresponding local file without performing any authorization checks against the attachment’s parent object (Issue/Comment/Release) or the repository it belongs to. As a result, even attachments under private repositories can be downloaded by an unauthenticated user (or a user without proper permissions) as long as the UUID is known.

Relevant code (internal/cmd/web.go:306):

m.Get("/attachments/:uuid", func(c *context.Context) {
	attach, err := database.GetAttachmentByUUID(c.Params(":uuid"))
	if err != nil {
		c.NotFoundOrError(err, "get attachment by UUID")
		return
	} else if !com.IsFile(attach.LocalPath()) {
		c.NotFound()
		return
	}

	fr, err := os.Open(attach.LocalPath())
	if err != nil {
		c.Error(err, "open attachment file")
		return
	}
	defer fr.Close()

	c.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox")
	c.Header().Set("Cache-Control", "public,max-age=86400")
	c.Header().Set("Content-Disposition", fmt.Sprintf(`inline; filename="%s"`, attach.Name))

	if _, err = io.Copy(c.Resp, fr); err != nil {
		c.Error(err, "copy from file to response")
		return
	}
})

The UUID lookup itself also performs no validation tied to repository visibility or user permissions. Authorization is not enforced at this layer.

Relevant code (internal/database/attachment.go:124):

// GetAttachmentByUUID returns attachment by given UUID.
func GetAttachmentByUUID(uuid string) (*Attachment, error) {
	return getAttachmentByUUID(x, uuid)
}

Preconditions

The attacker knows the target attachment’s UUID (i.e., the attachment URL).
For unauthenticated exploitation: [auth] REQUIRE_SIGNIN_VIEW = false.
Even when REQUIRE_SIGNIN_VIEW = true, exploitation may still be possible because the handler does not check repository-level permissions; a user who can log in but lacks access to the target repository may still retrieve the attachment.

Steps to Reproduce

Log in as an administrator and create a private repository, e.g. myadmin/idor-attach-1770724346-1a13bb.
Add an attachment to an Issue in that repository and note the attachment UUID
(example UUID used during testing: f06d90f8-5b62-4c10-ac8d-f11fdf870b57).
Log out and access the following as an unauthenticated user:

The repository page → 404 Not Found
The Issue page under that repository → 404 Not Found
GET /attachments/<uuid> → the attachment file is successfully downloaded

Minimum Required Privileges

REQUIRE_SIGNIN_VIEW = false: none (works without authentication).
REQUIRE_SIGNIN_VIEW = true: only the ability to log in (repository view permission is not required in practice).

Impact

Confidential information attached to private repositories or restricted Issues/Releases may be disclosed.
- Examples include credentials, cryptographic keys, personal data, internal documents, or unpublished source code fragments.
While the severity depends on the attachment contents, attachments frequently contain sensitive data, making the potential impact high.

来源与许可

本页自动同步 GitHub Advisory Database 的公开数据，并保留上游原文供核验；不宣称原创分析。数据许可：CC-BY-4.0。