Free practical cybersecurity guidance for organisations without a security team.
hello@actionsoncyber.com
Actions On Cyber logo
Contact
← Back to Vulnerability Briefs

Critical Security Flaw in Gogs Software Could Let Attackers Take Control

A serious security weakness has been found in Gogs, a software tool used for managing code repositories. This flaw could allow someone with access to the system to run harmful commands remotely, potentially taking control of the affected computer. This matters because it could lead to data loss or disruption if exploited.

28 May 2026

Reference: CVE-2024-39930

1. What is being reported?

The built-in SSH server in Gogs versions up to 0.13.0 has a vulnerability that lets an attacker who is already logged in send a specially crafted request to run malicious commands on the server. This is called remote code execution. However, this issue does not affect Gogs installations on Windows computers.

2. What this means in plain English

If your organisation uses Gogs on Linux or Mac systems and has the built-in SSH server enabled, an attacker who gains access could take over the system and cause serious damage. This could include stealing data, disrupting services, or installing harmful software.

3. Could this affect a small business?

Small businesses or charities using Gogs on Linux or Mac with the built-in SSH server turned on could be at risk. Those using Windows versions of Gogs or not using the built-in SSH server are likely not affected.

4. What to do now

  • Check if your organisation uses Gogs software and identify the operating system it runs on.
  • Confirm whether the built-in SSH server feature is enabled in your Gogs setup.
  • If affected, contact your IT provider or software supplier to apply any available updates or mitigations.
  • Monitor your systems for any unusual activity and review access controls to limit who can log in.

5. Ask your IT provider

Can you confirm if our Gogs installation is affected by the CVE-2024-39930 vulnerability and what steps are being taken to protect us?

6. Bottom line

If you use Gogs on Linux or Mac with the built-in SSH server enabled, act quickly to check and secure your system against this critical flaw.

Information based on NVD, CISA KEV, and reputable security reporting.

Back to Vulnerability Briefs