# Gogs Critical RCE via Path Traversal in Organization Names (CVE-2026-52813)

> A CVSS 10.0 path traversal vulnerability in Gogs (open-source self-hosted Git service) allows unauthenticated attackers to achieve remote code execution as the git user. The root cause is the absence of input sanitization on the createOrgRequest API struct, enabling organization names with '../' sequences. By chaining this with a legitimate worktree and native Git push to overwrite hooks/update files, attackers achieve RCE. Fixed in Gogs 0.14.3, with confirmed active exploitation in the wild since June 26, 2026.

- **Published:** 2026-08-20T00:00:00Z
- **Last reviewed:** 2026-08-29T08:22:07.453Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2092
- **ID:** TL-2026-2092
- **Severity:** CRITICAL (CVSS 10)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-52813, CVE-2026-52810

## Description

Gogs (Go Git Service) is a lightweight, open-source self-hosted Git service written in Go, serving approximately 1,140-1,400 internet-facing instances globally with a strong concentration in China (46%), the United States (20%), and India (12%). Used by universities, indie game studios, freelance consultants, and enterprises including GFG Alliance ($20B revenue), the National Indigenous Australians Agency, and Université de Montpellier, Gogs has been in the spotlight for security incidents throughout 2026, including a CISA directive in January 2026 requiring federal agencies to patch a prior RCE flaw (CVE-2025-8110) that compromised over 700 exposed servers.

CVE-2026-52813 (CVSS 10.0, CWE-23 Relative Path Traversal) is a critical vulnerability in Gogs' organization name handling. The root cause lies in two locations. First, the UserPath() function in internal/repox/repox.go joins the repository root directory with the username via filepath.Join() without sanitizing for '../' sequences — Go's filepath.Join() does not prevent directory traversal. Second, the createOrgRequest struct in internal/route/api/v1/org.go uses the binding constraint binding:"Required" without the AlphaDashDot restriction that protects user registration usernames, allowing arbitrary characters including '../' in organization names. The fix, merged in PR #8334 by author unknwon, applies pathx.Clean() to both UserPath() and RepositoryPath() and adds the AlphaDashDot;MaxSize(35) binding constraint to the API struct.

The attack chain involves five steps. Step 1: The attacker registers on a Gogs instance (default configuration allows self-registration) and creates a normal repository with a file via the UI, which triggers worktree creation at /data/gogs/data/tmp/local-r/{ID}/. Step 2: Using the API, the attacker creates an organization with a path-traversal name (e.g., '../../gogs/data/tmp/local-r/1') targeting that worktree directory. Step 3: The attacker creates a repository under the traversal org, placing a bare Git repository (e.g., traversal.git) inside the legitimate worktree folder. Step 4: The attacker clones the normal repository and pushes a malicious hooks/update file via native Git push — the UI blocks paths containing '.git/' but the nested repo is named traversal.git (not .git), so the check passes. Step 5: The attacker triggers the hook by committing to the traversal repo via the API, executing the injected shell commands as the git user. The published PoC demonstrates uid=1000(git) via the command id>/tmp/pwned.

Active exploitation in the wild has been confirmed by multiple sources. KEVIntel sensors observed 127 exploitation attempts from 30 unique attacker IPs across 5 sensors, with first observation on June 26, 2026 and last observed activity on August 17, 2026. Shadowserver Foundation honeypots detected connection attempts on July 9 and July 11, 2026 with 70% confidence. The CISA KEV status remains ambiguous — some sources (CTIWatch, VulnCheck KEV, GCVE DB) list it as known exploited with CISA attribution, while KEVIntel and NotCVE report it as not yet in the official CISA KEV catalog. The SSVC assessment from CISA-ADP confirms PoC exploitation is available, the vulnerability is automatable, and technical impact is total. Multiple public exploit scripts have been published, including by the actor 'thecodeb0ss'.

Gogs version 0.14.3, released June 7, 2026, addresses 20+ security issues including this vulnerability. Related fixes in the same release include: CVE-2026-52810 (CVSS 7.1, push authorization bypass via service query parameter confusion — partially unpatched due to case-sensitive comparison), GHSA-6vxv-wg6j-5qwp (stored XSS in .ipynb file rendering via the outdated notebookjs library, where innerHTML assignment triggers event handlers before sanitization), SSRF via webhook redirects (GHSA-c4v7-xg93-qf8g), SSRF via mirror sync (GHSA-g2f5-gjr4-qjvm), remote command execution via pull request rebase with crafted branch names (GHSA-qf6p-p7ww-cwr9), reverse proxy authentication bypass (GHSA-w6j9-vw59-27wv), stored XSS in milestone dropdown (GHSA-vcm5-gvmp-78mp), arbitrary file write via symlink upload (GHSA-89mr-xqfv-758m), and multiple other stored XSS, privilege escalation, and information disclosure vulnerabilities. The Aikido Security blog notes that the push authorization bypass fix in CVE-2026-52810 remains incomplete as of the publication date, with a manual code patch required for the case-sensitive comparison issue.

The impact is severe. Gogs serves as a critical infrastructure component for many organizations — hosting source code repositories, CI/CD pipelines, and internal tooling. An attacker achieving RCE as the git user gains access to all hosted repositories, can inject backdoors into source code, exfiltrate intellectual property, and use the compromised server as a pivot point for lateral movement within the organization's network. Given the default self-registration configuration, no authentication is required to initiate the attack chain. The technology sector accounts for 81.2% of Gogs deployments, followed by telecommunications (15.54%), education (1.34%), and government (0.21%). Immediate upgrade to Gogs 0.14.3 or later is the only complete remediation.

## MITRE ATT&CK

- T1595 Active Scanning
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1546 Event Triggered Execution
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1082 System Information Discovery
- T1565 Data Manipulation
- T1136.001 Create Account
- T1505.003 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Defense Evasion
- T1036 Masquerading
- T1059.004 Command and Scripting Interpreter
- T1595.002 Active Scanning
- T1565.001 Data Manipulation

## Sources

- [Aikido Security — Fixed: RCE in Gogs (CVE-2026-52813)](https://www.aikido.dev/blog/fixed-rce-gogs-cve-2026-52813)
- [GitHub Security Advisory GHSA-c39w-43gm-34h5](https://github.com/advisories/GHSA-c39w-43gm-34h5)
- [NVD Entry — CVE-2026-52813](https://nvd.nist.gov/vuln/detail/CVE-2026-52813)
- [The Hacker News — Gogs 10.0 RCE, n8n Workflow to RCE](https://thehackernews.com/2026/08/threatsday-gogs-100-rce-n8n-workflow-to.html)
- [Gogs Commit f6acd46 — Fix path traversal in owner and repo names](https://github.com/gogs/gogs/commit/f6acd467305943aae8403cbac81f0118dd1235d7)
- [Gogs v0.14.3 Release](https://github.com/gogs/gogs/releases/tag/v0.14.3)
- [Gogs PR #8334 — Security fix for path traversal](https://github.com/gogs/gogs/pull/8334)
- [KEVIntel — CVE-2026-52813 Exploitation Tracking](https://kevintel.com/CVE-2026-52813)
- [GCVE DB — CVE-2026-52813](https://db.gcve.eu/vuln/cve-2026-52813)
- [GHSA-wmfg-5p4h-5fw3 — Push Authorization Bypass (CVE-2026-52810)](https://github.com/advisories/GHSA-wmfg-5p4h-5fw3)
- [GHSA-6vxv-wg6j-5qwp — Stored XSS in .ipynb via notebookjs](https://github.com/advisories/GHSA-6vxv-wg6j-5qwp)
- [Shadowserver Foundation — CVE-2026-52813 Honeypot Data](https://www.shadowserver.org/)
- [NVD Entry — CVE-2026-52810](https://nvd.nist.gov/vuln/detail/CVE-2026-52810)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2092