CVE Intelligence
Analysis AI-assisted

CVE-2026-52813: Gogs Path Traversal in Organization Names Leading to Remote Code Execution

Gogs versions before 0.14.3 accept organization names containing path traversal sequences, which can cause repository data to be written to arbitrary filesystem locations. The record states this can be used to overwrite repository hook configuration and achieve remote code execution, and that the issue is fixed in 0.14.3. The CVSS 3.1 base score of 10.0 is reported as critical by the CNA.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

Gogs is an open source, self-hosted Git service. CVE-2026-52813 is classified as relative path traversal (CWE-23). The record states that organization names containing ../ sequences are accepted, so repository data can be placed outside the intended directory.

Impact

  • According to the record, data for repositories can be stored and retrieved at arbitrary locations on the filesystem.
  • The record states that a nested structure of Git repositories can be used to overwrite the hooks configuration of another repository, which may result in remote code execution.
  • The CNA and GitHub Security Advisories assign a critical severity with a CVSS 3.1 base score of 10.0. The record does not describe the impact beyond these statements.

Affected products and versions

  • Product: Gogs, the open source self-hosted Git service.
  • The record states that versions prior to 0.14.3 are affected.
  • The structured affected list in the record is empty, so the exact affected range cannot be confirmed from the data provided.

Exploitation status

  • The record shows the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score is available.
  • No confirmed exploitation appears in the sources consulted for this analysis.

Remediation and mitigation

  • Upgrade Gogs to version 0.14.3 or later, as stated in the record and the referenced release.
  • Until the upgrade is complete, restrict who can create organizations and review which users have that permission.
  • Limit the filesystem permissions of the account that runs the Gogs service so that it cannot write outside its data directories.
  • Consult the GitHub security advisory GHSA-c39w-43gm-34h5 for vendor guidance.

Detection guidance

  • Review existing organization names for ../ sequences or other unexpected path separators.
  • Check repository storage directories for entries located outside the expected root, and review recent changes to repository hook configuration.
  • Monitor for the creation of unexpected nested repository structures.

Limitations of the available information

  • The structured affected and fixed-version fields in the record are empty. The 0.14.3 fixed version is taken from the description and the Gogs v0.14.3 release reference.
  • The record does not state whether the vulnerability has been exploited outside the sources consulted.
  • It is unknown whether upgrading removes any malicious artifacts already created on the filesystem.
  • It is unknown whether forks or packaged distributions of Gogs are affected differently.
  • The record's source status is Deferred.

Frequently asked questions

Which Gogs versions are affected by CVE-2026-52813?

The record states that Gogs versions prior to 0.14.3 are affected. The structured affected-version list in the record is empty, so the exact range is not confirmed by the data provided.

Is CVE-2026-52813 known to be actively exploited?

The record shows no CISA KEV listing and no EPSS score. No confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.