Gogs Vulnerability Allows Remote Code Execution via Path Traversal

Feedly

Gogs Vulnerability Allows Remote Code Execution via Path Traversal

First seen 24 Jun 2026, 09:30 UTC • •72.0

Article Content

1 / 5

Browse articles

ThreatCluster •June 25, 2026 at 09:24 UTC

•Gogs allows path traversal in organization names, leading to RCE.
•Unsanitized input during repository creation enables arbitrary filesystem access.
•Users are advised to upgrade to Gogs version 0.14.3 or later to mitigate risks.

Gogs, a self-hosted Git service, has a vulnerability allowing path traversal in organization names. This flaw permits attackers to create nested Git repositories, leading to the potential for Remote Code Execution (RCE) by overwriting hooks configurations. The issue arises from unsanitized organization names during repository creation, allowing paths like ../../../../tmp/test to be used. This vulnerability affects all versions of Gogs prior to 0.14.3. The CVE-2026-52813 has been assigned to this vulnerability, highlighting its severity. Security advisories have been issued, and users are urged to update their installations. The flaw emphasizes the need for proper input sanitization in web applications.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 112d ago How this analysis works

Timeline

2026-06-24

CVE-2026-52813 published

Gogs vulnerability allows path traversal in organization names, leading to RCE. Affected versions are prior to 0.14.3.

2026-06-24

Security advisory released

GitHub Advisories released a security advisory regarding the Gogs vulnerability, urging users to update.

2026-06-24

Gogs vulnerability confirmed

The vulnerability was confirmed by multiple sources, detailing the exploit method and impact on users.

advisories.gitlab.com

More articles in this cluster (4)

Threat Graph

6 entities, 5 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Remote Code Execution
Zero-day Exploit

Organization (1)

Gogs

Vulnerability (1)

CVE-2026-52813

Weakness (1)

CWE-22 - Path Traversal

Tool (1)

Git

Relationships

Git exploits CVE-2026-52813
CVE-2026-52813 related to Remote Code Execution
CVE-2026-52813 related to Zero-day Exploit
CVE-2026-52813 related to Gogs
CVE-2026-52813 related to CWE-22 - Path Traversal

Following this threat?

Track Gogs and CVE-2026-52813 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…

Critical Zero-Day Exploit Found in BeyondTrust Remote Support BeyondTrust disclosed a critical vulnerability, CVE-2026-102764, in its Remote Support product, exploited by the suspected China-linked group ARMORY CASTLE since August 2026. This flaw, with a CVSS score of 9.3, allows attackers to perform arbitrary file uploads and gain host-level control without requiring…