Vulnerability intelligence

CVE-2026-52806

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.

CVSS Score

9.9

Critical

EPSS — Exploit Probability

1.5%

Riskier than 71% of all CVEs

Exploitation

Not in CISA KEV

No federal exploitation record

Remediation

unknown

Check vendor advisories

NVD entry PoC / advisory

1 article across 1 outlet · first covered Jun 26, 2026 · latest Jun 26, 2026

Coverage timeline

Critical RCE flaw CVE-2026-52813 hits Gogs, patch out
securityonline.info · Jun 26, 2026