PT-2026-51629 · Gogs · Gogs

Published

2026-06-23

·

Updated

2026-06-24

·

CVE-2026-52811

CVSS v4.0

9.0

Critical

VectorAV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
Name of the Vulnerable Software and Affected Versions Gogs versions 0.14.0 through 0.14.2
Description An issue exists where the UploadRepoFiles function only checks for symbolic links at the leaf of the upload target using osx.IsSymlink(), unlike other functions that validate every component of the path. An attacker with repository write access can exploit this by performing a multipart upload with a filename containing a literal backslash. On Linux and macOS, filepath.Base preserves backslashes, which are subsequently converted to forward slashes by pathx.Clean(). This allows the attacker to redirect the write operation through a previously committed directory symlink.
Because iox.CopyFile() uses os.Create() without the O NOFOLLOW flag, the kernel follows the parent symlink, enabling the attacker to write arbitrary bytes to any location the Gogs UID has permissions to access. Potential targets include ~git/.ssh/authorized keys to gain SSH access or <repo>.git/hooks/post-receive to achieve remote code execution (RCE) on the next push. Windows builds are not affected due to different handling of path separators and default git configurations.
Recommendations For versions 0.14.0 through 0.14.2:
  • Replace the leaf check in repo editor.go with the hasSymlinkInPath() function to validate the entire path.
  • Validate opts.TreePath before calling os.MkdirAll() to prevent directory creation outside the repository.
  • Update iox.CopyFile() to use the O NOFOLLOW flag when opening files to prevent symlink following at the syscall layer.
  • Modify database.NewUpload to reject any name containing / or `` after pathx.Clean() is called.
  • As a temporary mitigation, restrict write access to repositories to trusted users only.

Fix

Link Following

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-59CWE-61CWE-22

Related Identifiers

CVE-2026-52811
GHSA-89MR-XQFV-758M

Affected Products

Gogs