Path Traversal in Gogs Leads to Remote Code Execution

Compliance Impact

CVE-2026-52813 allows attackers to execute remote code by exploiting path traversal vulnerabilities in Gogs, potentially leading to unauthorized access and modification of data stored on the filesystem.

Such unauthorized access and control over data could result in violations of data protection regulations like GDPR and HIPAA, which mandate strict controls over data confidentiality, integrity, and availability.

Specifically, the vulnerability's ability to compromise confidentiality (C), integrity (I), and availability (A) of data, as indicated by its CVSS score, means affected organizations could fail to meet compliance requirements that require safeguarding sensitive information and preventing unauthorized system access.

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in Gogs, an open source self-hosted Git service, in versions prior to 0.14.3. It allows organization names containing path traversal sequences (../) to be accepted, which causes repositories to be stored or retrieved at arbitrary filesystem locations. By exploiting this, an attacker can create nested Git repositories that overwrite each other's hooks configuration, potentially leading to Remote Code Execution (RCE).

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized access and control over the system running Gogs. Because it allows Remote Code Execution without any privileges or user interaction, an attacker can execute arbitrary code remotely, potentially compromising confidentiality, integrity, and availability of the system and data.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability in Gogs is fixed in version 0.14.3. To mitigate this vulnerability, you should immediately upgrade your Gogs installation to version 0.14.3 or later.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking for the presence of organization names containing path traversal sequences (e.g., ../) in your Gogs instance prior to version 0.14.3. Specifically, you should look for organizations created with names that include sequences like "../../../" or similar patterns that could allow repositories to be written outside the intended directories.

To detect such potentially malicious organizations or repositories, you can query the Gogs database or API for organization names containing path traversal patterns.

• Use a command or script to search the Gogs database for organization names with '../' or similar sequences.
• Example SQL query (adjust according to your database schema): SELECT * FROM organizations WHERE name LIKE '%../%';
• Use curl or similar tools to attempt creating an organization with a path traversal name and observe if the request is rejected (in patched versions) or accepted (in vulnerable versions). For example: curl -X POST -d '{"username":"../../../tmp/poc"}' -H 'Content-Type: application/json' https://your-gogs-instance/api/v1/orgs

If the request is accepted and the organization is created, your system is vulnerable. If it is rejected with a 422 Unprocessable Entity error, the fix is in place.

Useful 0 Not Useful 0