8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52797

CVE-2026-52797: Gogs: Overwriting critical files results in a denial of service

Vulnerability type: Path Traversal Impact: DoS Exploitation prerequisite: authorized user Description: As an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the target directory and write the result of the comparison to any arbitrary path. Researcher: Artyom Kulakov (Positive Technologies) Mitigation:

https://github.com/gogs/gogs/blob/b7372b1f32cd0bb40984debfb049e3fc04efaee4/internal/route/repo/editor.go#L307 — on this line, instead of the treePath variable, which comes directly from the user unchanged, we should first filter and then pass the entry variable.
To filter the treePath variable, it is better to use the preexisting pathutil.Clean function instead of path.Clean from the standard Go library.

Exploitation

A Positive Technologies researcher discovered that the user has the ability to preview their changes when editing a file in the repository. The POST /:user/:repo/_preview/:branch/:path_to_file method is responsible for displaying the changes. The problem is how the POST /:user/:repo/_preview/:branch/:path_to_file method processes the value passed to the :path_to_file (see Listing 1).

Listing 1. _preview method processor

func DiffPreviewPost(c *context.Context, f form.EditPreviewDiff) {
	// В treePath попадает значение из :path_to_file
	treePath := c.Repo.TreePath

    // Проверка, что файл существует в репозитории
	entry, err := c.Repo.Commit.TreeEntry(treePath)

	-cut-

	// Значение, полученное от пользователя, передается в функцию в обход фильтра
	diff, err := c.Repo.Repository.GetDiffPreview(c.Repo.BranchName, treePath, f.Content)

	-cut-

The first problem to solve is to make the TreeEntry function think that the value passed in is a file that actually exists in the repository. To do this, we must consider how the function actually makes this decision (see Listing 2).

Miggo Vulnerability Database

→

CVE-2026-52797

CVE-2026-52797:

8.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	<= 0.13.4	0.14.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis:

In progress

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

8.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-52797: Gogs: Overwriting critical files results in a denial of service

Exploitation

Listing 1. _preview method processor

CVE-2026-52797:

8.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

8.5

8.5

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Technical Details

CVE-2026-52797: Gogs: Overwriting critical files results in a denial of service

Exploitation

Listing 1. _preview method processor

Listing 2. Path checking and cleaning function

Figure 1. Example of filter bypass

Listing 3. Change comparison function

Table 1. Results of the `path.Clean` function operation

Figure 2. Example of a successful attack

8.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-52797: Gogs: Overwriting critical files results in a denial of service

Exploitation

Listing 1. _preview method processor

CVE-2026-52797:

8.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

8.5

8.5

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Technical Details

CVE-2026-52797: Gogs: Overwriting critical files results in a denial of service

Exploitation

Listing 1. _preview method processor

Listing 2. Path checking and cleaning function

Figure 1. Example of filter bypass

Listing 3. Change comparison function

Table 1. Results of the path.Clean function operation

Figure 2. Example of a successful attack

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Table 1. Results of the `path.Clean` function operation