Multiple Critical Vulnerabilities in Gogs Allow Remote Code Execution and Data Compromise

The Centre for Cybersecurity Belgium (CCB) has issued an urgent advisory warning of multiple critical vulnerabilities affecting Gogs, a self-hosted Git service, in versions prior to 0.14.3. These flaws, including CVE-2026-52813 (CVSS 10.0), CVE-2026-52806 (CVSS 9.9), and CVE-2026-52811 (CVSS 9.0), introduce significant risks such as remote code execution, path traversal, command injection, and arbitrary file write capabilities. Attackers can leverage these weaknesses to bypass application boundaries, manipulate server file paths, and execute arbitrary commands. The vulnerabilities pose a severe threat, potentially leading to full host operating system takeover, exfiltration of proprietary source code, and subsequent lateral movement into connected corporate infrastructure. Organizations using affected Gogs installations are strongly urged to patch immediately.

Attack Chain

1. Initial Access / API Interaction (CVE-2026-52813): An unauthenticated attacker sends a crafted API request containing a malicious organization name to a vulnerable Gogs instance.
2. Path Traversal & Command Execution (CVE-2026-52813): The Gogs server processes the unsanitized organization name, triggering a path traversal vulnerability that allows arbitrary command execution on the underlying operating system.
3. OR Authenticated Access & Malicious Pull Request (CVE-2026-52806): An attacker with standard user privileges creates a pull request using a maliciously crafted branch name.
4. Argument Injection & Remote Code Execution (CVE-2026-52806): A privileged user (e.g., administrator) initiates a "Rebase before merging" action on the malicious pull request, causing argument injection into the git rebase command, leading to remote code execution on the Gogs server.
5. OR Arbitrary File Write Setup (CVE-2026-52811): An attacker commits a directory symlink to a repository hosted on the vulnerable Gogs instance.
6. Arbitrary File Write (CVE-2026-52811): The attacker then uploads a crafted filename. When this file is processed, it is routed through the previously committed symlink, enabling the attacker to write arbitrary files outside the repository's working directory, potentially overwriting sensitive system files.
7. Impact & System Takeover: Successful exploitation of any of these RCE or arbitrary file write vulnerabilities leads to full host operating system takeover, enabling theft of proprietary source code and subsequent lateral movement within the connected corporate infrastructure.

Impact

The successful exploitation of these critical Gogs vulnerabilities (CVE-2026-52813, CVE-2026-52806, CVE-2026-52811) carries severe consequences. Attackers can achieve full host operating system takeover, gain complete control over the server, and steal proprietary source code or other sensitive data. The ability to execute arbitrary code and write files outside the repository working tree allows for extensive system compromise, including the potential for installing backdoors, maintaining persistence, and facilitating lateral movement into connected corporate infrastructure and production networks. This could severely disrupt operations, lead to significant data breaches, and compromise the integrity of development pipelines.

Recommendation

• Patch CVE-2026-52813, CVE-2026-52806, and CVE-2026-52811 by upgrading Gogs instances to version 0.14.3 or later immediately.
• Implement enhanced monitoring to identify any suspicious API requests, unusual git rebase command executions, or unexpected file write activities originating from Gogs servers, particularly for instances affected by CVE-2026-52813, CVE-2026-52806, and CVE-2026-52811.
• Review Gogs logs for evidence of exploitation related to CVE-2026-52813 (malicious organization names in API requests), CVE-2026-52806 (crafted branch names in pull requests and git rebase executions), and CVE-2026-52811 (unusual file writes from Gogs processes).