Detect Gogs Path Traversal in Organization Name Leading to RCE via Git Hooks in CrowdStrike LogScale
CVE-2026-52813 is a critical path traversal vulnerability (CVSS 10.0) in Gogs versions prior to 0.14.3. An attacker can craft a malicious organization name containing path traversal sequences (e.g., '../') to write arbitrary Git hook files outside the intended repository directory. This allows remote code execution on the Gogs server by placing executable hook scripts in controlled locations. A public PoC is available, making active exploitation likely.
MITRE ATT&CK
LogScale Detection Query
#event_simpleName IN (NetworkConnectIP4, NetworkConnectIP6, ProcessRollup2, FileOpenInfo, FileWrittenInfo)
| $gogs_process = (ImageFileName = /gogs/i OR CommandLine = /gogs/i)
| $path_traversal_url = (RequestURL = /\.\.\/|\.\.%2[Ff]|%2e%2e%2[Ff]|%2e%2e%5[Cc]/i)
| $org_endpoint = (RequestURL = /org|organization|\/api\/v1\/orgs/i)
| $hook_write = (TargetFileName = /\.git[\/\\]hooks[\/\\]/i)
| ($path_traversal_url AND $org_endpoint) OR ($gogs_process AND $hook_write)
| table _time, aid, ComputerName, UserName, ImageFileName, CommandLine, RequestURL, TargetFileName
| sort _time descCrowdStrike Falcon Query Language rule correlating path traversal requests to Gogs organization endpoints and Gogs process-initiated writes to .git/hooks directories, covering both the initial exploitation vector and the hook-planting payload of CVE-2026-52813.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate Gogs server-side hooks configured by administrators that trigger file writes
- CI/CD pipeline agents that interact with Gogs via API and manage hook configurations
- Security tools running on the Gogs host that scan repository directories
- Automated repository mirroring or backup tools that access hook file paths
Other platforms for CVE-2026-52813
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Gogs Org Creation with Path Traversal Name (Unauthenticated PoC)
Expected signal: HTTP POST to /api/v1/orgs with path traversal in username field; possible filesystem write to .git/hooks/ outside expected path; Gogs process creating files in unexpected directories
- Test 2Manual Git Hook File Placement via Traversal (Filesystem Simulation)
Expected signal: File creation event for executable file in .git/hooks path; auditd syscall write/chmod events; inotify events if configured on Gogs data directory
- Test 3Verify Gogs Version and Patch Status
Expected signal: HTTP GET requests to Gogs API version endpoint; web scraping of Gogs home page; process execution of gogs binary with --version flag
- Test 4Post-Exploitation: Execute Command via Planted Git Hook
Expected signal: Git push operation triggering hook execution; child process spawned by Gogs with UID of Gogs service; file write to /tmp/rce_proof.txt; network connection from Gogs process if hook establishes reverse shell
Unlock Pro Content
Get the full detection package for CVE-2026-52813 including response playbook, investigation guide, and atomic red team tests.