10

CVE-2026-52813: Gogs: Path Traversal in organization name results in RCE through Git hooks

Deferred
AliasesGHSA-c39w-43gm-34h5GO-2026-5305
Published 24-06-2026Last modified 26-06-2026

Vulnerability summary

CVE-2026-52813 is a critical (CVSS 10.0) Relative Path Traversal vulnerability in gogs. EPSS estimates a 1.11% chance of exploitation in the next 30 days, higher than 65.8% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 10 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
1.11%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 1
OPENSUSE-SU-2026:21483-1

Timeline

  1. 24-06-2026
    PublishedVulnerability first disclosed.
  2. 26-06-2026
    Last modifiedVulnerability information updated.

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

1.11%

Chance of exploitation in the next 30 days

Percentile

66%

Versus all other CVEs

30-day change

No change 0.00 pp

From 1.11% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Gogs1 product
Gogs.io1 product
  • gogs< 0.14.3 | All versions (No fix recorded)

2 vendors · 2 products

References

6 links