Path Traversal Vulnerability in Gogs Git Service

CVE-2026-52813

What is CVE-2026-52813?

The Gogs Git service, an open-source platform for self-hosted Git management, is susceptible to a path traversal vulnerability that permits the acceptance of organization names containing traversal sequences (../). This flaw allows for the writing and storing of repositories at arbitrary locations within the filesystem, potentially leading to the compromise and manipulation of repository configurations. By exploiting this vulnerability, an attacker can craft nested structures of Git repositories that overwrite one another's hooks, resulting in Remote Code Execution (RCE). This vulnerability has been resolved in version 0.14.3.

References