Warning: Multiple Vulnerabilities in Gogs Allow Remote Code Execution, Patch Immediately!
Multiple critical vulnerabilities affecting Gogs installations prior to version 0.14.3 have been disclosed. These flaws allow attackers to execute arbitrary code, bypass application boundaries, and perform unauthorized file writes outside the repository working tree.
This has the potential impact of full host operating system takeover, theft of proprietary source code, and subsequent lateral movement into connected corporate infrastructure and production networks.
CVE-2026-52813, CVSS 10
CWE-23: Relative Path Traversal
A Remote Code Execution (RCE) vulnerability caused by path traversal. This flaw is triggered by improper sanitization of organization names accepted through the API, allowing an attacker to manipulate server file paths and execute arbitrary commands.
CVE-2026-52806, CVSS 9.9
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
An authenticated Remote Code Execution (RCE) vulnerability via argument injection. An attacker with standard user privileges can achieve RCE by creating a pull request with a maliciously crafted branch name. This exploits the merge operation by injecting the --exec flag into the git rebase command during a "Rebase before merging" action.
CVE-2026-52811, CVSS 9.0
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-59: Improper Link Resolution Before File Access ('Link Following') CWE-61: UNIX Symbolic Link (Symlink) Following
An arbitrary file write vulnerability allowing modifications outside the repository working tree. This is executed via a crafted upload filename routed through a committed directory symlink, permitting an attacker to overwrite sensitive files.
Patch The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.
Monitor/Detect The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity, ensuring a swift response in case of an intrusion.
In case of an intrusion, you can report an incident via .
While patching appliances or software to the newest version may provide safety from future exploitation, it does not remediate historic compromise.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
