Detect Gogs Path Traversal in Organization Name Leading to RCE via Git Hooks in IBM QRadar
CVE-2026-52813 is a critical path traversal vulnerability (CVSS 10.0) in Gogs versions prior to 0.14.3. An attacker can craft a malicious organization name containing path traversal sequences (e.g., '../') to write arbitrary Git hook files outside the intended repository directory. This allows remote code execution on the Gogs server by placing executable hook scripts in controlled locations. A public PoC is available, making active exploitation likely.
MITRE ATT&CK
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
sourceip,
destinationip,
destinationport,
URL,
username,
'CVE-2026-52813' AS cve,
magnitude,
category,
logsourcename(logsourceid) AS log_source
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) IN ('Apache HTTP Server', 'Nginx', 'Microsoft IIS', 'Linux OS', 'Custom Log Source')
AND (
(URL ILIKE '%org%' OR URL ILIKE '%organization%' OR URL ILIKE '%/api/v1/orgs%')
AND (
URL ILIKE '%../%'
OR URL ILIKE '%..\\%'
OR URL ILIKE '%.%2e%2f%'
OR URL ILIKE '%..%2f%'
OR URL ILIKE '%..%5c%'
OR URL ILIKE '%%2e%2e%%'
)
)
OR (
payload ILIKE '%gogs%'
AND payload ILIKE '%.git%'
AND payload ILIKE '%hook%'
AND (payload ILIKE '%../%' OR payload ILIKE '%..\\%')
)
ORDER BY starttime DESC
LAST 24 HOURSQRadar AQL query to surface HTTP requests containing path traversal sequences targeting Gogs organization endpoints and log entries showing suspicious hook-related activity, aligned with CVE-2026-52813.
Data Sources
Required Tables
False Positives & Tuning
- Automated API testing frameworks that test Gogs endpoints with special characters
- URL encoding edge cases in organization names submitted by non-malicious users
- Log noise from web application firewalls replaying blocked requests for analysis
- Internal security red team exercises targeting the Gogs instance
Other platforms for CVE-2026-52813
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Gogs Org Creation with Path Traversal Name (Unauthenticated PoC)
Expected signal: HTTP POST to /api/v1/orgs with path traversal in username field; possible filesystem write to .git/hooks/ outside expected path; Gogs process creating files in unexpected directories
- Test 2Manual Git Hook File Placement via Traversal (Filesystem Simulation)
Expected signal: File creation event for executable file in .git/hooks path; auditd syscall write/chmod events; inotify events if configured on Gogs data directory
- Test 3Verify Gogs Version and Patch Status
Expected signal: HTTP GET requests to Gogs API version endpoint; web scraping of Gogs home page; process execution of gogs binary with --version flag
- Test 4Post-Exploitation: Execute Command via Planted Git Hook
Expected signal: Git push operation triggering hook execution; child process spawned by Gogs with UID of Gogs service; file write to /tmp/rce_proof.txt; network connection from Gogs process if hook establishes reverse shell
Unlock Pro Content
Get the full detection package for CVE-2026-52813 including response playbook, investigation guide, and atomic red team tests.