Arbitrary File Deletion Flaw in Gogs Wiki Update Enables Path Traversal

Gogs disclosed a security advisory for an arbitrary file deletion vulnerability in its wiki page update functionality, tracked as GHSA-jp7c-wj6q-3qf2. The flaw stems from a path traversal issue that can let an attacker manipulate file paths during wiki updates and delete files outside the intended directory, creating a risk to repository integrity and server-side data stored by the self-hosted Git service.

A public repository referencing CVE-2026-24135 later documented the same issue as an arbitrary file deletion bug in Gogs caused by wiki path traversal, indicating that technical details are now publicly accessible. Organizations running Gogs should review exposed wiki features, assess whether untrusted users can modify wiki content, and prioritize vendor guidance and patching to prevent unauthorized deletion of application or system files.