Reported by 2 outlets
Critical Gogs Flaw Enables Remote Code Execution Through Path Traversal
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 1.00 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.55 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Critical Gogs Flaw Enables Remote Code Execution Through Path Traversal
gbhackers.com · 45d ago · August 29th, 2026
A critical vulnerability in Gogs, the self-hosted Git service, could allow authenticated attackers to execute commands on the server by abusing path traversal during creation. Tracked as CVE-2026-52813, the flaw was reported by Aikido security researcher Jorian Woltjer and fixed in Gogs version 0.14.3. The issue stems from an API endpoint that accepted unsanitized organization […] The post Critical Gogs Flaw Enables Remote Code Execution Through Path Traversal appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Critical Gogs Path Traversal Flaw Enables Remote Code Execution via Git Hooks
cyberpress.org · 45d ago · August 29th, 2026
A critical path traversal vulnerability in Gogs, the self-hosted Git service, could let authenticated attackers achieve remote code execution by planting malicious Git hooks outside the intended repository storage directory. Tracked as CVE-2026-52813 , the flaw arises from an API endpoint that accepted unsanitized organization usernames and passed them to a filesystem path-construction routine. The finding underscores how small validation gaps in Git hosting software can combine with Git’s filesystem behavior to produce server-side code execution under the service account used to run Git operations remotely. Critical Gogs Path Traversal Flaw The vulnerable code used filepath.Join to append an organization name to the configured repository root. Although Gogs restricted ordinary user registrations to safe alphanumeric, dash, underscore, and period characters, its API organization-creation request did not apply equivalent validation. An attacker could therefore name an organization with ../ sequences, such as a traversal path targeting /tmp , then create a repository within it. Gogs would create the repository’s bare Git directory at that attacker-chosen filesystem location. Bare repositories normally contain metadata rather than a working copy, initially limiting the path traversal to a constrained file-write primitive rather than to arbitrary file replacement. Jorian Woltjer escalated that primi