PT-2026-51631 · Gogs · Gogs

Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-52813

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gogs (affected versions not specified)

Description Gogs fails to sanitize organization names, allowing the use of path traversal sequences (../). This enables the storage and retrieval of repository data at arbitrary locations on the filesystem. An attacker can exploit this by creating a nested structure of Git repositories to overwrite the hooks configuration of another repository. Specifically, by targeting the local worktree directory, an attacker can modify the hooks/update script to include malicious Bash commands. When the hook is triggered, it results in Remote Code Execution (RCE) with the privileges of the git user. The issue occurs because the os.MkdirAll() function in internal/database/org.go is called using the unsanitized org.Name variable.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Relative Path Traversal

Weakness Enumeration

CWE-23

Related Identifiers

CVE-2026-52813

GHSA-C39W-43GM-34H5

Affected Products

Gogs

References · 7

• https://osv.dev/vulnerability/GHSA-c39w-43gm-34h5 · Vendor Advisory
• https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5 · Note
• https://github.com/gogs/gogs/pull/8334 · Note
• https://github.com/gogs/gogs/commit/f6acd467305943aae8403cbac81f0118dd1235d7 · Note
• https://github.com/gogs/gogs/releases/tag/v0.14.3 · Note
• https://github.com/gogs/gogs · Note
• https://twitter.com/dailycve/status/2069484363834630384 · Twitter Post