The write never touches the git protocol. Gogs exposes a file modification API, PutContents, and that is where the earlier path traversal lived [9]. The maintainers' fix for CVE-2024-55947, reported by ManassehZhou, added input validation on the path parameter [9][10]. That check covers the string you sent. Resolution happens later, when the file is opened. The link is an ordinary committed git object, because Gogs follows standard Git behaviour and permits symlinks that point outside the repository [11]. Write through one and the filesystem does the traversal on your behalf [13]. The productive target is .git/config, where setting sshCommand converts a file write into command execution [14].
On the counts: more than 700 compromised against more than 1,400 exposed works out near one in two [19]. Both figures are floors, and the denominator is what an external scan can see [6], so every instance behind a VPN or on an internal subnet sits outside it. For that rate to say anything about your install, the install has to be internet-reachable with repository creation and registration at their shipped defaults, which Wiz reports is common [15][7]. If it is reachable, the version string is not a defence. The infected host ran 0.13.2, a build that already carried the fix for CVE-2024-55947 [16].
Gogs earns its deployments on easy setup and minimal resource usage [8]. In my experience that is the profile of a service someone stands up on a spare VM for a team of five and never enters in an asset inventory. It also holds source code, and on this bug it hands over execution on the host that holds it [14]. Note where the detection came from: malware findings on a customer workload, not from the Gogs instance itself [1]. The repository list carried the tell, with names no human chose [17]. Nobody was reading it.
Wiz places this in a run of symlink handling flaws in the same codebase, alongside CVE-2024-56731 and CVE-2024-54148 [18]. That history is what changes the value of the upgrade for me. It closes this write path [4]. It does not change the underlying fact that the API accepts symlinks as normal repository content [11], and the class of bug has now been exploited more than once in the same component. So in my context the release goes on with open registration turned off and proxy authentication in front, because the API should not be reachable by anyone who can load a signup page.
