PT-2026-50159 · Gogs · Gogs
CVE-2026-52797
·
Published
2026-06-16
·
Updated
2026-07-30
CVSS v3.1
8.5
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H |
Name of the Vulnerable Software and Affected Versions
Gogs versions prior to 0.14.0
Description
An authorized user can manipulate the value passed to the
git diff command to bypass the target directory and write the result of a comparison to an arbitrary path. This path traversal issue occurs because the application fails to properly filter user-supplied input before passing it to a system command. Specifically, the POST endpoint '/:user/:repo/ preview/:branch/:path to file' processes the :path to file variable using the DiffPreviewPost() function, which subsequently calls GetDiffPreview(). By utilizing specific character sequences that exploit the behavior of the path.Clean function, an attacker can bypass validation checks and inject the --output parameter into the git diff command. This allows the attacker to overwrite critical files, such as the gogs.db database or the app.ini configuration file, potentially leading to a denial of service (DoS).Recommendations
Update to version 0.14.0.
In the
DiffPreviewPost() function, filter the treePath variable and pass the entry variable instead.
Use the pathutil.Clean function to filter the treePath variable instead of the standard Go library path.Clean function.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gogs