CVE-2026-52813criticalobserved exploitationCWE-23

CVE-2026-52813: critical vulnerability in gogs

Gogs: Path Traversal in organization name results in RCE through Git hooks

Published · Updated

Follow this CVE+ Monitor gogs+ Monitor gogs.io/gogs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck and has a public proof of concept.

ssvc Actcvss 10epss 1.1%
from disclosure to weapon8 days
Published on NVDJun 24
1st PoC+8d
VulnCheck+2d
Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
gogs · gogs
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — gogs

In the same product, most dangerous first.

CVE-2024-55947HIGHGogs has a Path Traversal in file update APIEPSS 77.7%CVE-2022-32174CRITICALGogs - XSSEPSS 58.2%CVE-2026-52806CRITICALGogs: RCE via git rebase --exec argument injection in pull request mergeEPSS 7.9%CVE-2026-52815MEDIUMGogs: Unauthenticated Organization Teams Information Disclosure via APIEPSS 1.5%CVE-2025-64111CRITICALGogs's update .git/config file allows remote command executionEPSS 1.4%CVE-2024-56731CRITICALGogs deletion of internal files allows remote command executionEPSS 1.1%