build1 distinct publisher
Gogs checks the path, then follows the symlink out of the repository
The patch for the last Gogs RCE validated the path parameter and never looked at where a committed symlink pointed. Wiz counted more than 700 already-compromised instances before v0.13.4 shipped.
Publishers:wiz.io
Reality
- Evidence72
- Adoption74
- Hype gap+12
- Incentives68