CVE-2026-52813: Gogs Path Traversal Vulnerability

CVE-2026-52813 Overview

CVE-2026-52813 is a path traversal vulnerability in Gogs, an open source self-hosted Git service. Versions prior to 0.14.3 accept organization names containing path traversal sequences (../). Repositories created under these organizations are written to filesystem paths that follow the traversal, allowing data to be stored and retrieved at arbitrary filesystem locations. An attacker can create a nested structure of Git repositories that overwrites another repository's Git hooks configuration, leading to Remote Code Execution (RCE). The flaw is classified as [CWE-23: Relative Path Traversal] and is fixed in Gogs 0.14.3.

Critical Impact
Unauthenticated network attackers can overwrite Git hook scripts on the Gogs host, resulting in arbitrary command execution under the Gogs service account.

Affected Products

Gogs versions prior to 0.14.3
Self-hosted Gogs Git service deployments
Gogs container and binary distributions built from affected source

Discovery Timeline

2026-06-24 - CVE-2026-52813 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52813

Vulnerability Analysis

Gogs stores repositories on disk using a path constructed from the owner (user or organization) name and the repository name. The owner and repository name fields were not validated against path traversal sequences before being concatenated into filesystem paths. An attacker who can create an organization with a name such as ../target causes repository data to be placed outside the intended repository root.

By creating nested repositories that traverse into another repository's hooks directory, the attacker can write attacker-controlled content into files such as post-receive or pre-receive. When the legitimate repository receives a push or other Git operation, the Git server executes the overwritten hook script. This converts a file write primitive into full Remote Code Execution on the host running Gogs.

Root Cause

The root cause is missing input validation on owner and repository identifiers. The createOrgRequest structure accepted arbitrary strings for username, including characters such as / and .. that are meaningful to the filesystem. No allow-list constraint enforced an alphanumeric format, and no canonicalization check rejected traversal sequences before path construction.

Attack Vector

Exploitation requires network access to a Gogs instance that permits organization or user creation, which many public and internal deployments allow by default. The attacker registers an organization whose name embeds ../ segments, creates one or more repositories, and pushes content that lands inside the hooks directory of a victim repository owned by another account. The next Git operation against the victim repository triggers execution of the planted hook.

// Security patch in internal/route/api/v1/org.go
// security: reject path traversal in owner and repository names (#8334)
type createOrgRequest struct {
-	UserName    string `json:"username" binding:"Required"`
+	UserName    string `json:"username" binding:"Required;AlphaDashDot;MaxSize(35)"`
	FullName    string `json:"full_name"`
	Description string `json:"description"`
	Website     string `json:"website"`
}
// Source: https://github.com/gogs/gogs/commit/f6acd467305943aae8403cbac81f0118dd1235d7

The patch adds the AlphaDashDot binding and a maximum length, restricting organization names to alphanumeric characters, dashes, underscores, and dots. A companion change introduces an internal/pathx package used to sanitize path components before they are joined with the repository root.

Detection Methods for CVE-2026-52813

Indicators of Compromise

Organization or username values in the Gogs database containing .., /, or \ characters.
Unexpected files inside the hooks directory of repositories, particularly post-receive, pre-receive, or update scripts not deployed by administrators.
Repositories on disk located outside the configured repository.ROOT path defined in app.ini.
Outbound network connections or shell processes spawned by the Gogs service account immediately after a git push event.

Detection Strategies

Audit the Gogs database user and repository tables for owner names matching the regex \.\.|/|\\.
Compare hashes of all Git hook scripts under repository storage against a known-good baseline.
Inspect Gogs HTTP access logs for POST requests to /api/v1/orgs or /org/create with traversal characters in the request body.

Monitoring Recommendations

Forward Gogs application and access logs to a centralized log platform and alert on organization creation requests containing %2F, %2E%2E, or literal ../.
Monitor process execution under the Gogs service user for unexpected child processes such as sh, bash, curl, or wget.
Track filesystem writes outside the configured repository root using host-based file integrity monitoring.

How to Mitigate CVE-2026-52813

Immediate Actions Required

Upgrade all Gogs instances to version 0.14.3 or later without delay.
Disable self-service user and organization registration until the upgrade is complete by setting DISABLE_REGISTRATION = true in app.ini.
Audit existing organization and user names for traversal characters and remove or rename any suspicious accounts.
Review every repository's hooks directory for unauthorized scripts and restore them from a trusted baseline.

Patch Information

The vulnerability is fixed in Gogs 0.14.3. The fix is implemented in commit f6acd46 and merged through pull request #8334. Release binaries are available at the Gogs v0.14.3 release page. Refer to the GitHub Security Advisory GHSA-c39w-43gm-34h5 for additional details.

Workarounds

Restrict network access to the Gogs web interface to authenticated, trusted users using a reverse proxy or firewall rule.
Require administrator approval for new user and organization registration via the REGISTER_EMAIL_CONFIRM and ENABLE_CAPTCHA settings.
Run Gogs as a low-privilege user inside a container with a read-only filesystem outside the repository root to limit RCE blast radius.

bash

# Configuration example: disable open registration and enforce admin approval in app.ini
[service]
DISABLE_REGISTRATION       = true
REQUIRE_SIGNIN_VIEW        = true
REGISTER_EMAIL_CONFIRM     = true
ENABLE_CAPTCHA             = true

# Verify installed version after upgrade
gogs --version
# Expected output: Gogs version 0.14.3