SummaryAI-written · deepseek-v4-flashAI-written · deepseek-v4-flashWritten by a language model from the source data on this page. Not reviewed by a person. Generated 23 Oct 2026.
Gogs versions prior to 0.14.3 accept organization names containing path traversal sequences, allowing repositories to be written to arbitrary filesystem locations and potentially enabling remote code execution. This critical vulnerability affects users of the open source self-hosted Git service.
Official description · CVE.orgSource dataSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. Copied from CVE.org.
Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown.Breakdown
77.5 / 100
Exploited
Yes, in VulnCheck KEV
Reports
5
Tactics
0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 2 days after disclosure. Public exploit code (PoC-in-GitHub) appeared 27 days after disclosure.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linked
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
Am I affected? What do I upgrade to?
From GitHub Security Advisories and OSVSourceSource dataCopied from an authoritative feed: NVD, CVE.org, CISA KEV, FIRST EPSS or MITRE CTID mappings, or labelled by the annotators of a published dataset. GitHub Security Advisories and OSV.
1 package in 1 ecosystem. Main package: gogs.io/gogs.
Named in 5 threat reportsMachineMachine-matchedFound by keyword or pattern matching over threat-report text. Not reviewed by a person. Exact CVE id found in the report text.
5 reportsaikido.dev5
Reports are matched by finding the exact id CVE-2026-52813 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.