Detect Gogs Path Traversal in Organization Name Leading to RCE via Git Hooks in Elastic Security
CVE-2026-52813 is a critical path traversal vulnerability (CVSS 10.0) in Gogs versions prior to 0.14.3. An attacker can craft a malicious organization name containing path traversal sequences (e.g., '../') to write arbitrary Git hook files outside the intended repository directory. This allows remote code execution on the Gogs server by placing executable hook scripts in controlled locations. A public PoC is available, making active exploitation likely.
MITRE ATT&CK
Elastic Detection Query
sequence by host.name with maxspan=5m
[network where process.name : ("gogs", "gogs.exe") and
http.request.uri : ("*org*", "*organization*", "*/api/v1/orgs*") and
(
http.request.uri : ("*../*", "*..\\*", "*%2e%2e%2f*", "*%2e%2e%5c*", "*..%2f*", "*..%5c*")
or http.request.body.content : ("*../*", "*..\\*", "*%2e%2e*")
)
]
[file where process.name : ("gogs", "gogs.exe") and
file.path : ("*/.git/hooks/*", "*\\.git\\hooks\\*") and
event.action in ("creation", "overwrite")
]EQL sequence rule correlating a path traversal HTTP request to a Gogs org endpoint followed by suspicious Git hook file creation by the Gogs process, indicating active exploitation of CVE-2026-52813.
Data Sources
Required Tables
False Positives & Tuning
- Automated repository management tools that modify Git hooks as part of their workflow
- Developers with server access directly manipulating hook files for legitimate CI/CD purposes
- Security audit tools that test for path traversal vulnerabilities in controlled environments
- Migration scripts that recreate repository structures including hook directories
Other platforms for CVE-2026-52813
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Gogs Org Creation with Path Traversal Name (Unauthenticated PoC)
Expected signal: HTTP POST to /api/v1/orgs with path traversal in username field; possible filesystem write to .git/hooks/ outside expected path; Gogs process creating files in unexpected directories
- Test 2Manual Git Hook File Placement via Traversal (Filesystem Simulation)
Expected signal: File creation event for executable file in .git/hooks path; auditd syscall write/chmod events; inotify events if configured on Gogs data directory
- Test 3Verify Gogs Version and Patch Status
Expected signal: HTTP GET requests to Gogs API version endpoint; web scraping of Gogs home page; process execution of gogs binary with --version flag
- Test 4Post-Exploitation: Execute Command via Planted Git Hook
Expected signal: Git push operation triggering hook execution; child process spawned by Gogs with UID of Gogs service; file write to /tmp/rce_proof.txt; network connection from Gogs process if hook establishes reverse shell
Unlock Pro Content
Get the full detection package for CVE-2026-52813 including response playbook, investigation guide, and atomic red team tests.