Critical Unpatched Flaws Disclosed in Popular Gogs Open-Source Git Service

SonarSource disclosed four security flaws in the self-hosted Git service Gogs—three critical (CVE-2024-39930, CVE-2024-39931, CVE-2024-39932) and one high (CVE-2024-39933)—that, if exploited by authenticated users, can enable remote command execution, internal file deletion, and arbitrary file reads including source code and secrets. Exploitation requires authentication (and for one issue, specific SSH/environment conditions); Windows and Docker deployments are not vulnerable, but Debian/Ubuntu instances are due to env --split-string support. The report also warns of 'phantom secrets' in SCM systems where removed secrets may still be retrievable via mirrored or cached commit views.