CVE-2026-52811: Gogs Path Traversal Vulnerability

CVE-2026-52811 Overview

CVE-2026-52811 is a path traversal vulnerability (CWE-22) in Gogs, an open source self-hosted Git service. Versions prior to 0.14.3 contain a flaw in the (*Repository).UploadRepoFiles function that only checks for symlinks on the leaf of the upload target. An authenticated attacker with repository-write access can supply a multipart upload whose filename contains a backslash to redirect file writes through a previously-committed directory symlink. The result is arbitrary file write under the gogs UID, leading to SSH foothold or remote code execution on the next push.

Critical Impact
Attackers with low-privileged repository access can write arbitrary files to any path the gogs process can reach, including ~git/.ssh/authorized_keys and Git post-receive hooks, yielding full server compromise.

Affected Products

Gogs versions prior to 0.14.3
Self-hosted Gogs Git service instances on Linux
Fixed in Gogs 0.14.3

Discovery Timeline

2026-06-24 - CVE-2026-52811 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52811

Vulnerability Analysis

The vulnerability exists in internal/database/repo_editor.go within the UploadRepoFiles function. Sibling functions UpdateRepoFile, DeleteRepoFile, and GetDiffPreview use hasSymlinkInPath, which calls lstat on every path component. UploadRepoFiles instead calls osx.IsSymlink(targetPath), validating only the leaf component. This inconsistency leaves parent directory symlinks unchecked during multipart uploads.

An attacker first commits a directory symlink pointing outside the repository tree. They then upload a file whose multipart filename contains a literal backslash (\). On Linux, filepath.Base preserves the backslash, and pathx.Clean converts it to a forward slash, splicing additional path components into the target. The write proceeds through the attacker-controlled symlink.

The destination is opened by iox.CopyFile using os.Create, which omits the O_NOFOLLOW flag. The kernel follows the parent symlink, and attacker-controlled bytes land anywhere the gogs UID can write.

Root Cause

The root cause is inconsistent symlink validation across repository file operations. UploadRepoFiles validated only the final path component while sibling operations walked the full path. Combined with os.Create opening files without O_NOFOLLOW, the kernel transparently followed parent symlinks during writes.

Attack Vector

The attacker requires repository-write privileges and proceeds in two stages. First, they commit a directory symlink such as evil -> /home/git/.ssh. Second, they perform a web upload where the multipart filename is authorized_keys\ or similar, redirecting the write through the symlink. Writing to <repo>.git/hooks/post-receive achieves remote code execution on the next push to the repository.

 		targetPath := path.Join(dirPath, upload.Name)
 
-		// 🚨 SECURITY: Prevent updating files in surprising place, check if the target
-		// is a symlink.
-		if osx.IsSymlink(targetPath) {
+		// 🚨 SECURITY: Prevent touching files in surprising places, reject operations
+		// that involve symlinks.
+		if hasSymlinkInPath(localPath, path.Join(opts.TreePath, upload.Name)) {
 			return errors.Newf("cannot overwrite symbolic link: %s", upload.Name)
 		}

Source: Gogs Security Patch Commit 04cb8af. The patch replaces the leaf-only osx.IsSymlink check with hasSymlinkInPath, which validates every component of the upload path.

Detection Methods for CVE-2026-52811

Indicators of Compromise

Unexpected modifications to ~git/.ssh/authorized_keys or other files owned by the gogs service account.
New or modified Git server-side hooks such as post-receive, pre-receive, or update within <repo>.git/hooks/ directories.
Multipart upload requests to Gogs web endpoints where the filename field contains literal backslash (\) characters.
Recent commits that introduce directory symlinks pointing outside the repository tree.

Detection Strategies

Audit Gogs HTTP access logs for upload requests targeting /repo/*/upload endpoints with non-standard filename encodings.
Scan repository histories for committed symlinks whose targets resolve outside the repository working tree.
Monitor filesystem write events under /home/git/ originating from the gogs process and correlate with web upload activity.

Monitoring Recommendations

Enable file integrity monitoring on authorized_keys files and Git hook directories on hosts running Gogs.
Forward Gogs application logs and Linux audit records to a centralized SIEM for correlation between upload events and filesystem writes.
Alert on any new outbound SSH session originating from accounts that gained authorized_keys entries after a Gogs upload event.

How to Mitigate CVE-2026-52811

Immediate Actions Required

Upgrade all Gogs instances to version 0.14.3 or later without delay.
Audit the ~git/.ssh/authorized_keys file and all <repo>.git/hooks/ directories for unauthorized entries or scripts.
Review user accounts with repository-write permissions and revoke access for untrusted users.
Rotate SSH host keys and any credentials reachable by the gogs service account if compromise is suspected.

Patch Information

The fix is available in Gogs 0.14.3, released via GitHub Release v0.14.3. The patch in Pull Request #8332 replaces the leaf-only symlink check with hasSymlinkInPath, validating every component of the upload target. Full advisory details are published in GHSA-89mr-xqfv-758m.

Workarounds

Restrict repository-write permissions to fully trusted users until the upgrade is complete.
Run the Gogs process under a dedicated unprivileged UID with no write access to ~git/.ssh/ or other sensitive paths.
Disable the web-based file upload feature in Gogs configuration where operationally feasible.
Place Gogs behind a reverse proxy that rejects multipart upload filenames containing backslash characters.

bash

# Upgrade Gogs to the patched release
systemctl stop gogs
wget https://github.com/gogs/gogs/releases/download/v0.14.3/gogs_0.14.3_linux_amd64.tar.gz
tar -xzf gogs_0.14.3_linux_amd64.tar.gz -C /opt/
systemctl start gogs

# Verify version
/opt/gogs/gogs --version