CVE-2026-52811

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description An issue exists in the (*Repository).UploadRepoFiles function where symlink checks are performed only on the leaf of the upload target using osx.IsSymlink(targetPath), unlike other functions that validate every path component. An attacker with repository write access can exploit this by performing a multipart upload with a filename containing a literal backslash. On Linux, this backslash is preserved by filepath.Base and subsequently converted to a forward slash by pathx.Clean, allowing the write operation to be redirected through a previously committed directory symlink.

Because iox.CopyFile uses os.Create without the O NOFOLLOW flag, the system follows the parent symlink and writes arbitrary data anywhere the Gogs user ID has permissions. This can lead to an SSH foothold by overwriting ~git/.ssh/authorized keys or Remote Code Execution (RCE) by overwriting <repo>.git/hooks/post-receive. This issue affects Linux and macOS installations; Windows builds are not affected.

Recommendations Update Gogs to version 0.14.3. As a temporary mitigation, restrict repository write access to trusted users only. Restrict the use of the (*Repository).UploadRepoFiles function until the update is applied.