CVE-2026-52813

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description Gogs contains a path traversal flaw where organization names containing relative path sequences (e.g., ../) are accepted without proper sanitization. This occurs because the internal/database/org.go file calls os.MkdirAll() using the org.Name variable without validating it. An attacker can exploit this by creating an organization and repository with a crafted name to write data to arbitrary locations on the server's filesystem.

By creating a nested structure of Git repositories, a remote attacker can overwrite the hooks configuration of another repository. Specifically, by targeting the local worktree directory, an attacker can modify the hooks/update script to include malicious Bash commands. When the hook is triggered through subsequent Git operations, it results in Remote Code Execution (RCE) with the privileges of the git user.

Recommendations Update Gogs to version 0.14.3.