10

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52813

CVE-2026-52813: Gogs: Path Traversal in organization name results in RCE through Git hooks

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52813

CVE-2026-52813:

10

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	< 0.14.3	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a classic path traversal issue in Gogs. The root cause lies in the internal/repox/repox.go file, where the UserPath function failed to sanitize the input user string, which corresponds to an organization's name. An attacker could create an organization with a name containing path traversal sequences (e.g., ../../../../tmp/pwned). When a repository is created under this organization, Gogs would use the unsanitized name to construct a file path, leading to the repository being created outside of the intended directory structure.

The patch addresses this in two main ways. First, it applies a pathx.Clean() function within UserPath and RepositoryPath to strip any path traversal characters from the input. Second, as a secondary defense, it adds stricter validation to the API endpoint responsible for organization creation (createMyOrg in internal/route/api/v1/org.go), ensuring that organization names can only contain alphanumeric characters, dashes, and dots. Exploitation of this vulnerability would involve a call to createMyOrg, which in turn calls the vulnerable UserPath function, making both functions critical runtime indicators.

Vulnerable functions

gogs.io/gogs/internal/repox.UserPath

internal/repox/repox.go

This function constructs the file path for a user's directory. Before the patch, it did not sanitize the 'user' parameter, which is used as the organization name. This allowed path traversal sequences like '../' in the organization name, causing repositories to be created in arbitrary locations on the filesystem.

gogs.io/gogs/internal/repox.RepositoryPath

internal/repox/repox.go

This function constructs the full path to a repository. It was also patched to sanitize the 'repo' name to prevent path traversal, although the primary vulnerability was exploitable through the 'owner' (organization) name passed to `UserPath`.

gogs.io/gogs/internal/route/api/v1.createMyOrg

internal/route/api/v1/org.go

This API endpoint handles the creation of new organizations. The vulnerability was triggered by sending a malicious organization name (username) to this endpoint. The patch adds strict validation (`AlphaDashDot`) to the `UserName` field as a defense-in-depth measure to block path traversal characters at the API level.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.