Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Gogs |
|
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|---|
| Gogs |
|
References
History
Thu, 25 Jun 2026 05:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
Gogs
Gogs gogs |
|
| Vendors & Products |
Gogs
Gogs gogs |
Wed, 24 Jun 2026 21:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3. | |
| Title | Gogs: Path Traversal in organization name results in RCE through Git hooks | |
| Weaknesses | CWE-23 | |
| References |
| |
| Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-06-24T20:33:42.162Z
Reserved: 2026-06-08T18:11:06.660Z
Link: CVE-2026-52813
Vulnrichment
No data.
NVD
No data.
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-06-25T05:15:03Z