CVE-2026-52813: Gogs: Path Traversal in organization name results in RCE through Git hooks
No fix listed · Affected: gogs · Exploitation: public proof of concept (unverified)
ExploitationProof of concept public
Not in CISA KEV as of catalogue 2026.11.13 (13 Nov)
- In CISA KEV: not seen
- Exploited (reported): not seen
- Scanning observed: not seen
- Proof of concept public1 public GitHub repository (unverified), listed by PoC-in-GitHub21 Jul
- Not established: not seen
Higher than 66% of scored CVEs
DescriptionNVD
Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
What changed
- PoC-in-GitHub lists 1 public GitHub repository (unverified) PoC-in-GitHub
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 26 Jun.
- Critical RCE flaw CVE-2026-52813 hits Gogs, patch outSecurityOnline · first in our coverage
New articles also arrive in the RSS feed.