Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M
CVE-2026-52813Gogs: Path Traversal in organization name results in RCE through Git hooks
Critical 10.0
In plain English
A critical-severity security flaw in gogs from gogs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | gogs.io/gogs | 0.14.3 | GHSA-c39w-43gm-34h5 |
| Go | gogs.io/gogs | no fix listed | GO-2026-5305 |
Affected products (as reported)
Weakness: CWE-23 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5 x_refsource_CONFIRM
- https://github.com/gogs/gogs/pull/8334 x_refsource_MISC
- https://github.com/gogs/gogs/commit/f6acd467305943aae8403cbac81f0118dd1235d7 x_refsource_MISC
- https://github.com/gogs/gogs/releases/tag/v0.14.3 x_refsource_MISC