CVE-2026-23633: medium-severity vulnerability in gogs
Gogs has arbitrary file read/write via path traversal in Git hook editing
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.5epss 0.5%
In short
Gogs allows attackers to read or write arbitrary files on the server by exploiting path traversal in the Git hook editing feature. This can lead to unauthorized data access or system compromise.
Technical detail
A path traversal vulnerability (CWE-22) in Gogs Git hook editor allows authenticated or unauthenticated attackers to escape the intended directory context using directory traversal sequences, enabling arbitrary file read/write operations with the privileges of the Gogs process.
Summary generated and translated by AI from the official description.
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This issue has been patched in versions 0.13.4 and 0.14.0+dev.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected products
gogs · gogsRelated CVEs — gogs
In the same product, most dangerous first.
CVE-2024-55947HIGHGogs has a Path Traversal in file update APIEPSS 77.7%CVE-2022-32174CRITICALGogs - XSSEPSS 58.2%CVE-2026-52806CRITICALGogs: RCE via git rebase --exec argument injection in pull request mergeEPSS 7.9%CVE-2026-52815MEDIUMGogs: Unauthenticated Organization Teams Information Disclosure via APIEPSS 1.5%CVE-2025-64111CRITICALGogs's update .git/config file allows remote command executionEPSS 1.4%CVE-2024-56731CRITICALGogs deletion of internal files allows remote command executionEPSS 1.1%