{"id":"CVE-2026-52806","published":"2026-06-24T20:21:07Z","modified":"2026-06-26T03:55:44Z","title":"Gogs: RCE via git rebase --exec argument injection in pull request merge","vendor":"gogs","product":"gogs","tier":"core","eol":null,"affectedVersions":[{"vendor":"gogs","product":"gogs","versions":["< 0.14.3"]}],"description":{"text":"Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the \"Rebase before merging\" merge operation. This vulnerability is fixed in 0.14.3.","provenance":"source","from":"CVE.org"},"summary":{"text":"Gogs, the open source self-hosted Git service, contains an argument injection flaw in the \"Rebase before merging\" pull request merge operation, where a specially crafted branch name injects the --exec flag into the git rebase command. An authenticated user who can create a pull request can exploit this to execute code on the server, with no special configuration beyond using that merge option and no user interaction required, and it affects versions prior to 0.14.3.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:12Z"},"cvss":{"score":9.9,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.07934,"percentile":0.94725,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-06-28","exploitedFirstSeen":"2026-06-28","ransomware":false,"evidence":[{"url":"https://threats.wiz.io/all-incidents/cryptojacking-campaign-targeting-k8s-clusters","date":"2026-06-28"},{"url":"https://previdian.com/CVE-2026-52806","date":"2026-07-12"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":8,"pulses":[{"name":"Known_Cve | Jul 3, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a467360fd5345a95c1134b5","created":"2026-07-02"},{"name":"Known_Cve | Jul 2, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a4521db141f0288bb17ee33","created":"2026-07-01"},{"name":"Known_Cve | Jul 1, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a43d1031ebc95f74029d4f0","created":"2026-06-30"},{"name":"Known_Cve | Jun 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a427edbd4dca6604a2cc3e8","created":"2026-06-29"},{"name":"Known_Cve | Jun 29, 2026","url":"https://otx.alienvault.com/pulse/6a412c4864f54db469879a52","created":"2026-06-28"},{"name":"Known_Cve | Jun 28, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a3fdb781c71f37c26792282","created":"2026-06-27"},{"name":"Known_Cve | Jun 27, 2026","url":"https://otx.alienvault.com/pulse/6a3e89c3497e2f5f6104c391","created":"2026-06-26"},{"name":"Known_Cve | Jun 26, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6a3d38c4245503db43d1c490","created":"2026-06-25"}],"provenance":"machine"},"cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command"}],"references":[{"url":"https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/gogs/gogs/pull/8301","tags":["x_refsource_MISC"]},{"url":"https://github.com/gogs/gogs/commit/a9dbafbfd8e1020bacc626420238c01d75d03364","tags":["x_refsource_MISC"]},{"url":"https://github.com/gogs/gogs/releases/tag/v0.14.3","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.14.3","all versions"],"patched":["0.14.3"],"from":["GHSA-qf6p-p7ww-cwr9","GO-2026-5580"],"provenance":"source"}],"advisories":[{"id":"GHSA-qf6p-p7ww-cwr9","url":"https://github.com/advisories/GHSA-qf6p-p7ww-cwr9","severity":"CRITICAL","ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.14.3"],"patched":["0.14.3"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-39073","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39073","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-05-28","earliestUrl":"https://github.com/portbuster1337/CVE-2026-52806","repos":[{"name":"portbuster1337/CVE-2026-52806","url":"https://github.com/portbuster1337/CVE-2026-52806","stars":7,"created":"2026-05-28"}]},"metasploit":[{"name":"Gogs Git Rebase Argument Injection RCE","module":"exploit/multi/http/gogs_rebase_rce","type":"exploit","disclosureDate":"2026-03-17","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gogs_rebase_rce.rb"}],"nuclei":[{"id":"CVE-2026-52806","name":"Gogs <= 0.14.2 - Authenticated RCE via git rebase Argument Injection","severity":"critical","path":"http/cves/2026/CVE-2026-52806.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-52806.yaml"}],"first":{"date":"2026-03-17","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gogs_rebase_rce.rb"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-03-17","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2026-05-28","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gogs_rebase_rce.rb","provenance":"source"},{"date":"2026-06-24","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-52806","provenance":"source"},{"date":"2026-06-28","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://threats.wiz.io/all-incidents/cryptojacking-campaign-targeting-k8s-clusters","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":null},"priority":{"score":73.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 125 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.95,"detail":"percentile 0.9473"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":2.17,"detail":"8 pulses"},{"name":"CVSS severity","points":6.93,"detail":"base score 9.9"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}