Arbitrary File Access in Self-Hosted Git Service by Gogs
CVE-2026-23633

6.5MEDIUM

Key Information:

Vendor

Gogs

Status
Gogs
Vendor
CVE Published:
6 February 2026

What is CVE-2026-23633?

In Gogs, an open source self-hosted Git service, versions prior to 0.13.4 contain a vulnerability that allows unauthorized users to read and write arbitrary files through path traversal during Git hook editing. This issue poses significant security risks, enabling potential attackers to manipulate files on the server. Users are advised to update to version 0.13.4 or later to mitigate this risk.

Affected Version(s)

gogs < 0.14.0+dev < 0.14.0+dev

gogs < 0.13.4 < 0.13.4

References

https://github.com/gogs/gogs/security/advisories/GHSA-mrp...
x_refsource_CONFIRM

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.