by Kastro
Paper/Archive/CVE-2026-52813

CVE-2026-52813

gogs gogs — Gogs: Path Traversal in organization name results in RCE through Git hooks

EPSS 1%public exploitCVSS 10.0
critical.is priorityof 100
53
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 65.9.659 × 2013.2Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.

Affected

ProductAffectedFixed inSource
gogs< 0.14.3–CNA

Scores by source

GitHub_M (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5refgithub.com/gogs/gogs/pull/8334refgithub.com/gogs/gogs/commit/f6acd467305943aae8403cbac81f0118dd1235d7refgithub.com/gogs/gogs/releases/tag/v0.14.3