{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/gogs--0.14.3/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":10,"id":"CVE-2026-52813"},{"cvss":9.9,"id":"CVE-2026-52806"},{"id":"CVE-2026-52811"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=0D713120-944A-54D1-8462-A83F53952638\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["Gogs (\u003c 0.14.3)"],"_cs_severities":["critical"],"_cs_tags":["rce","path-traversal","command-injection","git","web-application","gogs"],"_cs_type":"advisory","_cs_vendors":["Gogs"],"content_html":"\u003cp\u003eThe Centre for Cybersecurity Belgium (CCB) has issued an urgent advisory warning of multiple critical vulnerabilities affecting Gogs, a self-hosted Git service, in versions prior to 0.14.3. These flaws, including CVE-2026-52813 (CVSS 10.0), CVE-2026-52806 (CVSS 9.9), and CVE-2026-52811 (CVSS 9.0), introduce significant risks such as remote code execution, path traversal, command injection, and arbitrary file write capabilities. Attackers can leverage these weaknesses to bypass application boundaries, manipulate server file paths, and execute arbitrary commands. The vulnerabilities pose a severe threat, potentially leading to full host operating system takeover, exfiltration of proprietary source code, and subsequent lateral movement into connected corporate infrastructure. Organizations using affected Gogs installations are strongly urged to patch immediately.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eInitial Access / API Interaction (CVE-2026-52813):\u003c/strong\u003e An unauthenticated attacker sends a crafted API request containing a malicious organization name to a vulnerable Gogs instance.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003ePath Traversal \u0026amp; Command Execution (CVE-2026-52813):\u003c/strong\u003e The Gogs server processes the unsanitized organization name, triggering a path traversal vulnerability that allows arbitrary command execution on the underlying operating system.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eOR Authenticated Access \u0026amp; Malicious Pull Request (CVE-2026-52806):\u003c/strong\u003e An attacker with standard user privileges creates a pull request using a maliciously crafted branch name.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eArgument Injection \u0026amp; Remote Code Execution (CVE-2026-52806):\u003c/strong\u003e A privileged user (e.g., administrator) initiates a \u0026quot;Rebase before merging\u0026quot; action on the malicious pull request, causing argument injection into the \u003ccode\u003egit rebase\u003c/code\u003e command, leading to remote code execution on the Gogs server.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eOR Arbitrary File Write Setup (CVE-2026-52811):\u003c/strong\u003e An attacker commits a directory symlink to a repository hosted on the vulnerable Gogs instance.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eArbitrary File Write (CVE-2026-52811):\u003c/strong\u003e The attacker then uploads a crafted filename. When this file is processed, it is routed through the previously committed symlink, enabling the attacker to write arbitrary files outside the repository's working directory, potentially overwriting sensitive system files.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImpact \u0026amp; System Takeover:\u003c/strong\u003e Successful exploitation of any of these RCE or arbitrary file write vulnerabilities leads to full host operating system takeover, enabling theft of proprietary source code and subsequent lateral movement within the connected corporate infrastructure.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe successful exploitation of these critical Gogs vulnerabilities (CVE-2026-52813, CVE-2026-52806, CVE-2026-52811) carries severe consequences. Attackers can achieve full host operating system takeover, gain complete control over the server, and steal proprietary source code or other sensitive data. The ability to execute arbitrary code and write files outside the repository working tree allows for extensive system compromise, including the potential for installing backdoors, maintaining persistence, and facilitating lateral movement into connected corporate infrastructure and production networks. This could severely disrupt operations, lead to significant data breaches, and compromise the integrity of development pipelines.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-52813, CVE-2026-52806, and CVE-2026-52811\u003c/strong\u003e by upgrading Gogs instances to version 0.14.3 or later immediately.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImplement enhanced monitoring\u003c/strong\u003e to identify any suspicious API requests, unusual \u003ccode\u003egit rebase\u003c/code\u003e command executions, or unexpected file write activities originating from Gogs servers, particularly for instances affected by CVE-2026-52813, CVE-2026-52806, and CVE-2026-52811.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eReview Gogs logs for evidence of exploitation\u003c/strong\u003e related to CVE-2026-52813 (malicious organization names in API requests), CVE-2026-52806 (crafted branch names in pull requests and \u003ccode\u003egit rebase\u003c/code\u003e executions), and CVE-2026-52811 (unusual file writes from Gogs processes).\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T16:01:57Z","date_published":"2026-06-26T08:03:31Z","id":"https://feed.craftedsignal.io/briefs/2026-06-gogs-rce-patch/","summary":"Multiple critical vulnerabilities in Gogs versions prior to 0.14.3, including remote code execution (RCE) flaws (CVE-2026-52813, CVE-2026-52806) and arbitrary file write capabilities (CVE-2026-52811), enable attackers to achieve full host operating system takeover, steal proprietary source code, and facilitate lateral movement.","title":"Multiple Critical Vulnerabilities in Gogs Allow Remote Code Execution and Data Compromise","url":"https://feed.craftedsignal.io/briefs/2026-06-gogs-rce-patch/"}],"language":"en","title":"CraftedSignal Threat Feed - Gogs (\u003c 0.14.3)","version":"https://jsonfeed.org/version/1.1"}