Symlink Vulnerability in Gogs Self-Hosted Git Service

CVE-2026-52811

What is CVE-2026-52811?

Gogs, a self-hosted Git service, exhibits a vulnerability where the UploadRepoFiles function checks for symlinks only at the upload target's leaf, unlike other functions that comprehensively verify each component in the path. This oversight permits an attacker with repository write access to exploit a multipart upload where the filename contains a backslash, leading to a potential redirection of write operations via a previously-committed symlink. Consequently, this can enable unauthorized writing to sensitive locations such as the SSH authorized_keys file, or manipulation of post-receive hooks, potentially paving the way for remote code execution on subsequent pushes. The issue was resolved in version 0.14.3.

References