Gogs Critical RCE via Path Traversal in Organization Names (CVE-2026-52813)

Gogs Critical RCE via Path Traversal in Organization Names (TL-2026-2092) is a critical-severity software vulnerability scored CVSS 10, first published 2026-08-20 and last reviewed 2026-08-29. It has no confirmed attribution, affects Gogs Gogs, references 2 CVEs (CVE-2026-52813, CVE-2026-52810), maps to 15 MITRE ATT&CK techniques (T1036, T1059, T1059.004), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-2092

Threat ID
TL-2026-2092
Severity
CRITICAL
CVSS
10 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-08-20
Last reviewed
2026-08-29
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
technology, telecoms, education, government administration, finance, health
Target regions
china, united states of america, Europe, india, Asia Pacific
Detection rules
9
Indicators of compromise
15
Updates
2026-08-29 · revalidated 1× · latest source

Malware and tooling in Gogs Critical RCE via Path Traversal in Organization Names

Malware and tooling: Python

A CVSS 10.0 path traversal vulnerability in Gogs (open-source self-hosted Git service) allows unauthenticated attackers to achieve remote code execution as the git user. The root cause is the absence of input sanitization on the createOrgRequest API struct, enabling organization names with '../' sequences. By chaining this with a legitimate worktree and native Git push to overwrite hooks/update files, attackers achieve RCE. Fixed in Gogs 0.14.3, with confirmed active exploitation in the wild since June 26, 2026.

How Gogs Critical RCE via Path Traversal in Organization Names works

Gogs (Go Git Service) is a lightweight, open-source self-hosted Git service written in Go, serving approximately 1,140-1,400 internet-facing instances globally with a strong concentration in China (46%), the United States (20%), and India (12%). Used by universities, indie game studios, freelance consultants, and enterprises including GFG Alliance ($20B revenue), the National Indigenous Australians Agency, and Université de Montpellier, Gogs has been in the spotlight for security incidents throughout 2026, including a CISA directive in January 2026 requiring federal agencies to patch a prior RCE flaw (CVE-2025-8110) that compromised over 700 exposed servers.

CVE-2026-52813 (CVSS 10.0, CWE-23 Relative Path Traversal) is a critical vulnerability in Gogs' organization name handling. The root cause lies in two locations. First, the UserPath() function in internal/repox/repox.go joins the repository root directory with the username via filepath.Join() without sanitizing for '../' sequences — Go's filepath.Join() does not prevent directory traversal. Second, the createOrgRequest struct in internal/route/api/v1/org.go uses the binding constraint binding:"Required" without the AlphaDashDot restriction that protects user registration usernames, allowing arbitrary characters including '../' in organization names. The fix, merged in PR #8334 by author unknwon, applies pathx.Clean() to both UserPath() and RepositoryPath() and adds the AlphaDashDot;MaxSize(35) binding constraint to the API struct.

The attack chain involves five steps. Step 1: The attacker registers on a Gogs instance (default configuration allows self-registration) and creates a normal repository with a file via the UI, which triggers worktree creation at /data/gogs/data/tmp/local-r/{ID}/. Step 2: Using the API, the attacker creates an organization with a path-traversal name (e.g., '../../gogs/data/tmp/local-r/1') targeting that worktree directory. Step 3: The attacker creates a repository under the traversal org, placing a bare Git repository (e.g., traversal.git) inside the legitimate worktree folder. Step 4: The attacker clones the normal repository and pushes a malicious hooks/update file via native Git push — the UI blocks paths containing '.git/' but the nested repo is named traversal.git (not .git), so the check passes. Step 5: The attacker triggers the hook by committing to the traversal repo via the API, executing the injected shell commands as the git user. The published PoC demonstrates uid=1000(git) via the command id>/tmp/pwned.

Active exploitation in the wild has been confirmed by multiple sources. KEVIntel sensors observed 127 exploitation attempts from 30 unique attacker IPs across 5 sensors, with first observation on June 26, 2026 and last observed activity on August 17, 2026. Shadowserver Foundation honeypots detected connection attempts on July 9 and July 11, 2026 with 70% confidence. The CISA KEV status remains ambiguous — some sources (CTIWatch, VulnCheck KEV, GCVE DB) list it as known exploited with CISA attribution, while KEVIntel and NotCVE report it as not yet in the official CISA KEV catalog. The SSVC assessment from CISA-ADP confirms PoC exploitation is available, the vulnerability is automatable, and technical impact is total. Multiple public exploit scripts have been published, including by the actor 'thecodeb0ss'.

Gogs version 0.14.3, released June 7, 2026, addresses 20+ security issues including this vulnerability. Related fixes in the same release include: CVE-2026-52810 (CVSS 7.1, push authorization bypass via service query parameter confusion — partially unpatched due to case-sensitive comparison), GHSA-6vxv-wg6j-5qwp (stored XSS in .ipynb file rendering via the outdated notebookjs library, where innerHTML assignment triggers event handlers before sanitization), SSRF via webhook redirects (GHSA-c4v7-xg93-qf8g), SSRF via mirror sync (GHSA-g2f5-gjr4-qjvm), remote command execution via pull request rebase with crafted branch names (GHSA-qf6p-p7ww-cwr9), reverse proxy authentication bypass (GHSA-w6j9-vw59-27wv), stored XSS in milestone dropdown (GHSA-vcm5-gvmp-78mp), arbitrary file write via symlink upload (GHSA-89mr-xqfv-758m), and multiple other stored XSS, privilege escalation, and information disclosure vulnerabilities. The Aikido Security blog notes that the push authorization bypass fix in CVE-2026-52810 remains incomplete as of the publication date, with a manual code patch required for the case-sensitive comparison issue.

The impact is severe. Gogs serves as a critical infrastructure component for many organizations — hosting source code repositories, CI/CD pipelines, and internal tooling. An attacker achieving RCE as the git user gains access to all hosted repositories, can inject backdoors into source code, exfiltrate intellectual property, and use the compromised server as a pivot point for lateral movement within the organization's network. Given the default self-registration configuration, no authentication is required to initiate the attack chain. The technology sector accounts for 81.2% of Gogs deployments, followed by telecommunications (15.54%), education (1.34%), and government (0.21%). Immediate upgrade to Gogs 0.14.3 or later is the only complete remediation.

MITRE ATT&CK techniques used in TL-2026-2092

Defense Evasion

T1036 Masquerading; T1078 Valid Accounts; T1211 Exploitation for Defense Evasion

Execution

T1059 Command and Scripting Interpreter; T1059.004 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1078 Valid Accounts; T1136.001 Create Account; T1505.003 Server Software Component; T1546 Event Triggered Execution

Discovery

T1082 System Information Discovery

Impact

T1565 Data Manipulation; T1565.001 Data Manipulation

Reconnaissance

T1595 Active Scanning; T1595.002 Active Scanning

Affected products and versions in Gogs Critical RCE via Path Traversal in Organization Names

  • Gogs — Gogs
    Vulnerable versions: 0.1.0 through 0.14.2
    Fixed in: 0.14.3

Remediation for Gogs Critical RCE via Path Traversal in Organization Names

Patches

  • Upgrade to Gogs 0.14.3 or later — the only complete fix for CVE-2026-52813
  • For CVE-2026-52810 (push bypass), apply the manual case-insensitive patch from the Aikido Security advisory if remaining on older versions

Immediate actions

  • Upgrade Gogs to version 0.14.3 or later immediately
  • Review existing organizations for path traversal characters in names
  • Inspect all Gogs instances for unexpected files under /tmp/ and /data/gogs/data/tmp/local-r/
  • Check for unauthorized git hooks in repositories, especially hooks/update files
  • Audit user accounts for suspicious registrations and unexpected organization creation activity

Workarounds

  • Disable user self-registration (REQUIRE_SIGNIN_VIEW = true) and manage accounts manually
  • Restrict API access to trusted IP ranges via reverse proxy or firewall
  • Disable Git smart HTTP and use SSH-only repository access to prevent HTTP-based exploitation

Longer-term hardening

  • Evaluate migration from Gogs to actively maintained alternatives (Gitea, Forgejo, GitLab) due to single-maintainer governance model and recurring critical vulnerabilities
  • Implement runtime file integrity monitoring on Gogs data directories
  • Deploy WAF rules to block path traversal patterns (../) in API request payloads
  • Disable Git smart HTTP and use SSH-only access as a defense-in-depth measure
  • Establish a vulnerability management program with automated scanning for self-hosted infrastructure

CVEs associated with Gogs Critical RCE via Path Traversal in Organization Names

CVE-2026-52813, CVE-2026-52810

Weaknesses (CWE) in Gogs Critical RCE via Path Traversal in Organization Names

CWE-23, CWE-284

Timeline of Gogs Critical RCE via Path Traversal in Organization Names

  • Gogs v0.14.3 released with 20+ security fixes; PR #8334 merged by unknwon addressing path traversal in organization names
  • CVE-2026-52813 reserved for the path traversal vulnerability in Gogs
  • GitHub Security Advisory GHSA-c39w-43gm-34h5 published to Gogs repository by unknwon
  • GHSA-c39w-43gm-34h5 published to the GitHub Advisory Database; related advisories for CVE-2026-52810 (push bypass) and GHSA-6vxv-wg6j-5qwp (XSS) also published
  • NVD publishes CVE-2026-52813 with CVSS 10.0 critical severity rating and CWE-23 classification
  • First exploitation attempts observed in the wild by KEVIntel sensors — marks the start of active scanning and exploitation campaigns
  • GCVE DB confirms active exploitation in the wild; VulnCheck KEV lists CVE-2026-52813 as known exploited
  • Shadowserver Foundation honeypots detect exploitation attempts against CVE-2026-52813 with 70% confidence
  • Additional Shadowserver honeypot connection attempts detected; 2 connection events classified as http-scan type
  • Last observed exploitation attempt by KEVIntel sensors; cumulative total of 127 attempts from 30 unique attacker IPs across 5 sensors
  • Aikido Security publishes detailed technical writeup with full PoC, exploitation steps, and analysis of all three discovered vulnerabilities
  • The Hacker News publishes article covering Gogs RCE alongside n8n workflow automation vulnerability, highlighting the broader trend of trust exploitation in software defaults
  • GBHackers publishes 'Critical Gogs Flaw Enables Remote Code Execution,' extending public reporting beyond the existing record's last entry (2026-08-20); covered the same week in The Hacker News' ThreatsDay roundup.

Update history for TL-2026-2092

Sources cited for Gogs Critical RCE via Path Traversal in Organization Names

Threats related to Gogs Critical RCE via Path Traversal in Organization Names

Detection coverage for TL-2026-2092

As of 2026-08-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2092 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats