CVE Intelligence
Analysis AI-assisted

CVE-2026-52811: Gogs Path Traversal via Symlink Gap in UploadRepoFiles

CVE-2026-52811 affects Gogs, a self-hosted Git service, before 0.14.3. The repository file upload function checks for symlinks only on the final path component, unlike sibling file operations, which allows writes outside the intended directory. The CNA rates it critical (CVSS 4.0 score 9), the fix is in 0.14.3, and CISA KEV does not list it.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-52811 is a path traversal weakness (CWE-22) in the repository file upload handling of Gogs. According to the GitHub Security Advisory, the upload path checks for symlinks only on the final target, while sibling file operations inspect every path component.

Impact

  • The record describes arbitrary file writes within the reach of the Gogs service account.
  • Depending on the deployment, such writes could be chained into remote command execution or access to the host.
  • The CNA rates confidentiality, integrity and availability impact as high under CVSS 4.0 (score 9).

Affected products and versions

  • Gogs versions prior to 0.14.3, as stated in the record description.
  • The record does not include structured affected-version or fix data, so the affected and fixes lists are empty.

Exploitation status

CISA KEV does not list this CVE. No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Upgrade Gogs to 0.14.3 or later, as indicated in the v0.14.3 release.
  • Review the fix commit and the pull request if your team needs to validate the change.
  • Until the upgrade is applied, limit repository write access to trusted users and review who can upload files through the web interface.
  • Run the Gogs service account with the least filesystem privileges practical, so that writes are confined to what it needs.

Detection guidance

  • Audit repositories for unexpected symbolic links in directory trees, especially links introduced by recent commits.
  • Monitor the Gogs service account for file modifications outside its data directory, including SSH configuration and repository hook directories.
  • Review web upload activity and repository write events for unusual file names.

Limitations of the available information

  • The record gives no structured affected or fixed version ranges beyond the phrase prior to 0.14.3.
  • No CVSS v3 score is present, and no EPSS value is available, so exploitation likelihood is unknown.
  • The source status is listed as Deferred, and the record provides no proof-of-concept or exploitation telemetry.

Frequently asked questions

Which Gogs versions are affected by CVE-2026-52811?

According to the record description, Gogs versions prior to 0.14.3 are affected. The record does not provide structured affected version data.

Is CVE-2026-52811 known to be actively exploited?

CISA KEV does not list this CVE, and no confirmed exploitation appears in the sources consulted for this analysis.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.