CVE-2026-52806criticalobserved exploitationCWE-77

CVE-2026-52806: critical vulnerability in gogs

Gogs: RCE via git rebase --exec argument injection in pull request merge

Published · Updated

Follow this CVE+ Monitor gogs+ Monitor gogs.io/gogs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

85Vexday Risk Score

Patch now. It exploitation observed by VulnCheck and has a working public exploit.

ssvc Actcvss 9.9epss 7.9%
from disclosure to weaponsame day
Published on NVDJun 24
1st PoCMay 28
metasploitMar 17
VulnCheck+4d
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
gogs · gogs
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — gogs

In the same product, most dangerous first.

CVE-2024-55947HIGHGogs has a Path Traversal in file update APIEPSS 77.7%CVE-2022-32174CRITICALGogs - XSSEPSS 58.2%CVE-2026-52815MEDIUMGogs: Unauthenticated Organization Teams Information Disclosure via APIEPSS 1.5%CVE-2025-64111CRITICALGogs's update .git/config file allows remote command executionEPSS 1.4%CVE-2024-56731CRITICALGogs deletion of internal files allows remote command executionEPSS 1.1%CVE-2026-52813CRITICALGogs: Path Traversal in organization name results in RCE through Git hooksEPSS 1.1%