Gogs has a history of sitting on RCE bugs. this time, someone actually fixed it

Two critical bugs let anyone overwrite Git hooks and run code on your server — and for once, the fix shipped before it turned into the usual Gogs… Aliteq Priya Nair · Software & Systems Editor

Gogs patched CVE-2026-52813 (path traversal into Git hooks) and CVE-2026-52806 (argument injection via git rebase --exec) in version 0.14.3.

CVE-2026-52806 was scored CVSS 9.9 by Rapid7; any authenticated user could trigger it through a normal pull-request merge.

CVE-2026-52813 works by abusing unsanitized organization names to write repositories outside their intended directory, then overwriting Git hooks to get code execution.

Neither bug is known to be exploited in the wild — this was a coordinated disclosure, not an emergency zero-day.

If you're running Gogs below 0.14.3, treat this as urgent: update now, and audit who has push and PR-merge access to your instance.

I don't think Gogs earns a pass for 'fixed a bug it created.' But compared to the pattern Aikido describes, shipping both fixes in one coordinated release before anyone had to publish a working…

Read the full story

Aliteq Gogs has a history of sitting on RCE bugs. this time, someone actually fixed it Read the full story on Aliteq