CVE-2026-52813 is a critical vulnerability in Gogs, a widely used self-hosted Git service. It can allow an attacker to gain remote code execution on the server that hosts your source code, potentially exposing proprietary software, credentials, customer data, and internal documentation. Any organization operating an unpatched Gogs instance, especially one that permits user registration or external collaborators, should treat this as an urgent security priority. This post explains the vulnerability in business terms, identifies who is affected, provides practical scenarios, and gives security teams a clear detection and remediation path.
Gogs published its security advisory for CVE-2026-52813 on June 19, 2026, and the GitHub Advisory Database published the reviewed advisory on June 23, 2026. The National Vulnerability Database added the record on June 24, 2026. The flaw affects all Gogs versions before 0.14.3 and is fixed in Gogs 0.14.3.
The vulnerability is a relative path traversal issue, classified as CWE-23. In plain language, Gogs accepted organization names containing sequences such as ../ and used those names when deciding where to store repository files. An attacker could therefore cause repository data to be written outside its intended location. By arranging files in a particular way, the attacker could modify a Git hook and cause the server to execute attacker-controlled commands.
GitHub assigned the vulnerability a CVSS v3.1 base score of 10.0, the highest possible rating, with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The advisory credits JorianWoltjer as the researcher behind the public proof of concept, and Gogs addressed the issue through pull request 8334 and commit f6acd46.
If your organization uses Gogs to manage source code, infrastructure configurations, internal tools, or documentation, this vulnerability puts the server itself at risk, not merely the repositories stored on it. A successful attack can give an outsider the ability to run commands on the Gogs server with the privileges of the Git service account.github
That creates several immediate business risks. First, attackers may steal source code, API keys, database connection strings, deployment credentials, and other secrets stored in repositories or accessible from the compromised server. Second, they may alter code, insert malicious dependencies, or tamper with deployment configurations, creating a supply chain risk that can extend to customers and partners. Third, they may disrupt development operations by deleting repositories, corrupting data, or interfering with build and release processes.
The reputational and compliance consequences can be substantial. A breach involving source code or customer-related data may trigger contractual notifications, regulatory review, customer assurance questions, and costly incident response work. For organizations in healthcare, financial services, government contracting, or technology, the impact is amplified by confidentiality obligations and audit expectations.
The most important point is that the flaw is remotely exploitable, requires no user interaction, and in default configurations may require no special privileges if self-registration and organization creation are enabled. That combination makes unpatched internet-facing Gogs deployments especially exposed.github
Software Company With a Public Developer Portal: A mid-sized software company runs Gogs for internal engineering teams and allows contractors to register accounts. An attacker creates an organization with a malicious path traversal name, modifies a Git hook, and executes commands on the code server. The attacker extracts cloud credentials from a configuration repository and gains a path into the production deployment pipeline.
Regional Bank Using Gogs for Internal Automation: A regional bank operates a private Gogs instance to manage scripts used for reporting and account reconciliation. Although the instance is internal, a compromised employee laptop or stolen credential provides access. The attacker alters automation code to redirect files or capture sensitive information, creating operational disruption and audit findings.
Healthcare Technology Provider: A healthcare technology provider hosts Gogs in a container environment alongside integration tools. Because the Gogs process can write outside its expected directory, an attacker modifies hook scripts and gains code execution. The incident forces the provider to investigate whether patient-facing systems, integration credentials, or protected health information were accessed.
Small Managed Service Provider: A small managed service provider uses Gogs to store client automation scripts and network device configurations. An attacker compromises the Gogs server and reads configuration files containing administrative credentials. The provider must notify multiple clients, rotate credentials, and demonstrate that client environments were not affected.
If you operate Gogs or are uncertain whether it exists somewhere in your environment, do not wait for suspicious activity to confirm the risk. IntegSec can help you identify exposed instances, validate exploitation paths safely, review Git hook integrity, and prioritize remediation across your development infrastructure. Contact IntegSec for a professional penetration test and a practical cybersecurity risk reduction plan at https://integsec.com.
CVE-2026-52813 is a relative path traversal vulnerability in Gogs, tracked as CWE-23. During organization creation, internal/database/org.go calls os.MkdirAll(repox.UserPath(org.Name)) without sanitizing the organization name. Because the organization name is later used to construct the repository storage path, a name containing ../ causes Git bare repositories to be created outside the intended storage root.github
An attacker can create a nested repository structure that resolves into Gogs local repository worktree directories, such as /data/gogs/data/tmp/local-r/{ID}. Files within those directories, including config and hooks/update, can then be edited through Git. By writing malicious shell commands to hooks/update and triggering repository activity, the attacker achieves remote code execution as the git user.github
The attack vector is network-based, exploit complexity is low, no privileges are required in the default self-registration scenario, and no user interaction is needed. Scope is changed because the vulnerable component can affect resources beyond its intended security scope. The CNA-assigned vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, producing a CVSS 3.1 base score of 10.0. NVD lists the affected product as Gogs versions below 0.14.3 and identifies GitHub, Inc. as the CVE numbering authority.
Version enumeration:
docker inspect <container> --format '' and compare the image tag with the patched release.gogs.io/gogs; versions below 0.14.3 are affected.Scanner signatures and checks:
Log and behavioral indicators:
../, encoded traversal sequences, or unusually deep relative paths.hooks/update, for unexpected shell commands, encoded payloads, outbound network calls, or recent modification times.git user, new files in Gogs data directories, unusual Git push activity, or outbound connections from the Gogs host.1. Immediate, 0 to 24 hours:
../, encoded traversal characters, or unexpected path-like values.2. Short-term, 1 to 7 days:
3. Long-term, ongoing: