CVE-2026-52813

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 1.11%
EPSS Percentile: 65.59%
CISA KEV: Not listed

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 25-Jun-2026 04:16
Last Modified: 26-Jun-2026 12:16
EPSS Date: 2026-10-23
CWE: CWE-23

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 24-Oct-2026 14:19
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

A maximum-severity security flaw in Gogs (CVE-2026-52813, CVSS score: 10.0) could be exploited to achieve remote code execution through Git hooks. ThreatsDay: Gogs and n8n RCE Flaws, Malware Campaigns and AI Exploit Advances
This post will primarily focus on the Remote Code Execution vulnerability (CVE-2026-52813), as it is the most technically interesting. But I’ll also explain a logic bug to write on read-only repositories Researchers Detail Gogs RCE, Push Authorization Bypass and Notebook XSS

CVE (3)

Malware (8)

People (5)

Threat Actors (4)

MITRE ATT&CK (6)

Vendors (8)

Products (9)

Tools (4)

Industries (2)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.