CVE-2026-52797highCWE-22

CVE-2026-52797: high-severity vulnerability in gogs

Gogs: Overwriting critical files results in a denial of service

Published · Updated

Follow this CVE+ Monitor gogs+ Monitor gogs.io/gogs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.5epss 0.5%
Gogs is an open source self-hosted Git service. Prior to 0.14.0, as an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the target directory and write the result of the comparison to any arbitrary path. This vulnerability is fixed in 0.14.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Affected products
gogs · gogs
Related CVEs — gogs

In the same product, most dangerous first.

CVE-2024-55947HIGHGogs has a Path Traversal in file update APIEPSS 77.7%CVE-2022-32174CRITICALGogs - XSSEPSS 58.2%CVE-2026-52806CRITICALGogs: RCE via git rebase --exec argument injection in pull request mergeEPSS 7.9%CVE-2026-52815MEDIUMGogs: Unauthenticated Organization Teams Information Disclosure via APIEPSS 1.5%CVE-2025-64111CRITICALGogs's update .git/config file allows remote command executionEPSS 1.4%CVE-2024-56731CRITICALGogs deletion of internal files allows remote command executionEPSS 1.1%