CVE-2026-52813

Popis

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other-s hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.