{"id":"CVE-2026-52813","published":"2026-06-24T20:33:42Z","modified":"2026-06-26T03:55:38Z","title":"Gogs: Path Traversal in organization name results in RCE through Git hooks","vendor":"gogs","product":"gogs","tier":"core","eol":null,"affectedVersions":[{"vendor":"gogs","product":"gogs","versions":["< 0.14.3"]}],"description":{"text":"Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.","provenance":"source","from":"CVE.org"},"summary":{"text":"Gogs versions prior to 0.14.3 accept organization names containing path traversal sequences, allowing repositories to be written to arbitrary filesystem locations and potentially enabling remote code execution. This critical vulnerability affects users of the open source self-hosted Git service.","provenance":"ai","model":"deepseek-v4-flash","generatedAt":"2026-10-23T03:20:08Z"},"cvss":{"score":10,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01107,"percentile":0.65811,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-06-26","exploitedFirstSeen":"2026-06-26","ransomware":false,"evidence":[{"url":"https://previdian.com/CVE-2026-52813","date":"2026-06-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-09&host_type=src&vulnerability=cve-2026-52813","date":"2026-07-09"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2026-07-11&host_type=src&vulnerability=cve-2026-52813","date":"2026-07-11"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":10,"pulses":[{"name":"Critical RCEs: Gogs CVE-2026-52813, n8n CVE-2026-33696, SAP Commerce CVE-2026-58231 Exploitation","url":"https://otx.alienvault.com/pulse/6a8bdf170a547503307bdb2a","created":"2026-08-24"},{"name":"ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit and More","url":"https://otx.alienvault.com/pulse/6a874db73e7547c8cde5784c","created":"2026-08-20"},{"name":"Known_Cve | Jul 3, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a467360fd5345a95c1134b5","created":"2026-07-02"},{"name":"Known_Cve | Jul 2, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a4521db141f0288bb17ee33","created":"2026-07-01"},{"name":"Known_Cve | Jul 1, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a43d1031ebc95f74029d4f0","created":"2026-06-30"},{"name":"Known_Cve | Jun 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a427edbd4dca6604a2cc3e8","created":"2026-06-29"},{"name":"Known_Cve | Jun 29, 2026","url":"https://otx.alienvault.com/pulse/6a412c4864f54db469879a52","created":"2026-06-28"},{"name":"Known_Cve | Jun 28, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a3fdb781c71f37c26792282","created":"2026-06-27"},{"name":"Known_Cve | Jun 27, 2026","url":"https://otx.alienvault.com/pulse/6a3e89c3497e2f5f6104c391","created":"2026-06-26"},{"name":"Known_Cve | Jun 26, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6a3d38c4245503db43d1c490","created":"2026-06-25"}],"provenance":"machine"},"cwes":[{"id":"CWE-23","name":"Relative Path Traversal"}],"references":[{"url":"https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/gogs/gogs/pull/8334","tags":["x_refsource_MISC"]},{"url":"https://github.com/gogs/gogs/commit/f6acd467305943aae8403cbac81f0118dd1235d7","tags":["x_refsource_MISC"]},{"url":"https://github.com/gogs/gogs/releases/tag/v0.14.3","tags":["x_refsource_MISC"]}],"techniques":[],"reports":[{"id":"SRC-f5a9cf1dfa88b04dfb17","title":"S1ngularity/nx attackers strike again","publisher":"aikido.dev","url":"https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again","date":null,"mentions":[{"quote":"CVE-2026-52813 | An Aikido pentesting agent flagged a path traversal in Gogs.","start":5797,"end":5874}]},{"id":"SRC-e591d74920b2cb6324d8","title":"CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets Iran","publisher":"aikido.dev","url":"https://www.aikido.dev/blog/teampcp-stage-payload-canisterworm-iran","date":null,"mentions":[{"quote":"CVE-2026-52813 | An Aikido pentesting agent flagged a path traversal in Gogs.","start":14130,"end":14207}]},{"id":"SRC-9eed9f33e9ecf0c4d15a","title":"Popular telnyx package compromised on PyPI by TeamPCP","publisher":"aikido.dev","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm","date":null,"mentions":[{"quote":"CVE-2026-52813 | An Aikido pentesting agent flagged a path traversal in Gogs.","start":6626,"end":6703}]},{"id":"SRC-8defa212cd70e56c5cfe","title":"TeamPCP deploys CanisterWorm on NPM following Trivy compromise","publisher":"aikido.dev","url":"https://www.aikido.dev/blog/teampcp-deploys-worm-npm-trivy-compromise","date":null,"mentions":[{"quote":"CVE-2026-52813 | An Aikido pentesting agent flagged a path traversal in Gogs.","start":26879,"end":26956}]},{"id":"SRC-19d91ec425789b09caef","title":"GitHub User Compromised with Invisible Malware","publisher":"aikido.dev","url":"https://www.aikido.dev/blog/the-return-of-the-invisible-threat-hidden-pua-unicode-hits-github-repositorties","date":null,"mentions":[{"quote":"CVE-2026-52813 | An Aikido pentesting agent flagged a path traversal in Gogs.","start":6323,"end":6400}]}],"affected":[{"ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.14.3","all versions"],"patched":["0.14.3"],"from":["GHSA-c39w-43gm-34h5","GO-2026-5305"],"provenance":"source"}],"advisories":[{"id":"GHSA-c39w-43gm-34h5","url":"https://github.com/advisories/GHSA-c39w-43gm-34h5","severity":"CRITICAL","ecosystem":"Go","package":"gogs.io/gogs","vulnerableRanges":["<0.14.3"],"patched":["0.14.3"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2026-39084","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-39084","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2026-07-21","earliestUrl":"https://github.com/iqx6889/CVE-2026-52813-Gogs-RCE","repos":[{"name":"iqx6889/CVE-2026-52813-Gogs-RCE","url":"https://github.com/iqx6889/CVE-2026-52813-Gogs-RCE","stars":1,"created":"2026-07-21"}]},"first":{"date":"2026-07-21","source":"PoC-in-GitHub","url":"https://github.com/iqx6889/CVE-2026-52813-Gogs-RCE"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-06-24","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-52813","provenance":"source"},{"date":"2026-06-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://previdian.com/CVE-2026-52813","provenance":"source"},{"date":"2026-07-21","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/iqx6889/CVE-2026-52813-Gogs-RCE","provenance":"source"}],"speed":{"daysToPublicExploit":27,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":77.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 127 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":13.16,"detail":"percentile 0.6581"},{"name":"Named in threat reports","points":10.0,"detail":"5 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":2.36,"detail":"10 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}