Patchfirst
Patchfirst
CVE-2026-52806 Public exploit Critical · 9.9 EPSS 7.9%

Gogs: RCE via git rebase --exec argument injection in pull request merge

gogs · gogs

Summary

Gogs, the open source self-hosted Git service, contains an argument injection flaw in the "Rebase before merging" pull request merge operation, where a specially crafted branch name injects the --exec flag into the git rebase command. An authenticated user who can create a pull request can exploit this to execute code on the server, with no special configuration beyond using that merge option and no user interaction required, and it affects versions prior to 0.14.3.

Official description · CVE.org

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.

Breakdown
73.0 / 100
Exploited
Yes, in VulnCheck KEV
Reports
0
Tactics
0/15

First seen exploited 4 days after disclosure. Public exploit code (Metasploit) was available 3 months before disclosure.

  1. Public exploit codeMetasploit3 mo before
  2. Disclosedday 0
  3. First seen exploitedVulnCheck KEV evidence+4 days

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: gogs.io/gogs.

Gogogs.io/gogsGHSA-qf6p-p7ww-cwr9GO-2026-5580

Upgrade to 0.14.3

Fixes this CVE and 4 other known vulnerabilities in this package (CVE-2022-0415, CVE-2022-2024, +2).

Still affected on this line by CVE-2022-32174 (no fix published); CVE-2025-8110 (no fix published); CVE-2026-52813 (no fix published).

Also affected, despite being newer: All versions.

Gogo get gogs.io/gogs@v0.14.3

The first fix for CVE-2026-52806.

Affected versions, by release line

If you runUpgrade to
All versionsNo fix published
All versions before 0.14.30.14.3

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 8 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

4 links, grouped by NVD tag

x_refsource_CONFIRM 1

github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9

x_refsource_MISC 3

github.com/gogs/gogs/pull/8301github.com/gogs/gogs/commit/a9dbafbfd8e1020bacc626420238c01d75d03364github.com/gogs/gogs/releases/tag/v0.14.3
↑ ↓ chooseEnter openEsc close