6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23633

CVE-2026-23633: Gogs has arbitrary file read/write via path traversal in Git hook editing

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23633

CVE-2026-23633:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	<= 0.13.3	0.13.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal issue within the Gogs application. The root cause is the lack of input sanitization on the ':name' parameter in the URL for editing Git hooks. The functions SettingsGitHooksEdit (for reading hooks via GET) and SettingsGitHooksEditPost (for writing hooks via POST) in the file internal/route/repo/setting.go both used this user-controlled parameter directly when constructing a file path. As shown in the patch commit 4894629903f9508fe85567c44f68804f008f1655, the fix was to introduce a validation function, isValidHookName, which strictly checks if the provided hook name is a valid, expected value before it is used in any file operations. Before this fix, an attacker could supply URL-encoded path traversal sequences (e.g., ..%2f) in the :name parameter to read from or write to arbitrary files on the server, constrained only by the file system permissions of the Gogs process.

Vulnerable functions

SettingsGitHooksEdit

internal/route/repo/setting.go

This function handles GET requests for editing Git hooks. It directly used the unsanitized ':name' parameter from the URL to read a hook's content. A path traversal payload in ':name' would cause the function to read an arbitrary file from the filesystem and display its content to the attacker.

SettingsGitHooksEditPost

internal/route/repo/setting.go

This function handles POST requests for saving Git hooks. It directly used the unsanitized ':name' parameter from the URL to determine the file path to write the hook content to. A path traversal payload in ':name' would cause the function to write attacker-controlled content to an arbitrary file on the filesystem.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.