CVE-2026-52813: Critical Path Traversal in Gogs Enables RCE via Git Hooks

Vulnerability Overview

CVE-2026-52813 is a critical path traversal vulnerability (CVSS 10.0, CWE-23) in the Gogs self-hosted Git service. The root cause is insufficient sanitization of organization names during repository operations: an attacker can embed path traversal sequences such as ../ within an organization name to escape the intended repository directory boundary. By doing so, they can write arbitrary files — specifically Git hook scripts — to attacker-controlled locations on the server filesystem. Because Git hooks are executed automatically by the Gogs server process, placing a malicious hook results in remote code execution (RCE) with the privileges of the Gogs service account.

Affected Software

• Vendor: gogs.io (Go ecosystem)
• Product: gogs.io/gogs
• Affected versions: all releases prior to 0.14.3
• Fixed version: 0.14.3 (patch not yet published as of disclosure date 2026-06-23)

Organizations running self-hosted Gogs instances should treat all pre-0.14.3 deployments as fully compromised until patched or mitigated.

Exploitation Status

A public proof-of-concept (PoC) exploit is available, making active exploitation in the wild likely. This is not a theoretical or researcher-only finding — the combination of a CVSS 10.0 score, straightforward exploitation path, and public PoC means any internet-exposed or internally accessible Gogs instance should be considered at high risk. Defenders should prioritize detection and containment immediately; do not wait for a patch window.

How Our Detection Catches It

The df00tech detection pack for CVE-2026-52813 ships coverage across seven SIEM platforms. The detection logic centers on two complementary angles:

• HTTP request pattern analysis: Queries flag inbound requests to Gogs organization creation or settings endpoints where the organization name field contains path traversal sequences (../, URL-encoded equivalents, or repeated traversal chains). This catches the initial write primitive before a hook is executed.
• Git hook file creation outside expected paths: Where endpoint or file-integrity telemetry is available, rules alert on new or modified hook files (e.g., pre-receive, post-receive, update) written to filesystem paths that fall outside the canonical Gogs repositories directory structure.

Coverage is available for:

• Microsoft Sentinel — KQL analytic rule targeting web access logs and, where available, Sysmon/AuditD file-write events
• Splunk — SPL correlation search over web and endpoint sourcetypes
• Elastic — EQL sequence rule correlating HTTP anomalies with filesystem writes
• IBM QRadar — AQL rule on offense-level HTTP payload inspection
• Sumo Logic — CSE rule with request URI pattern matching
• Google Chronicle — YARA-L 2.0 rule targeting UDM HTTP events
• CrowdStrike — CQL detection on process and file-write telemetry from the Falcon sensor

Each query is tuned to minimize false positives in environments where legitimate Gogs traffic is present while ensuring the traversal pattern does not go undetected.

Recommended Response

Until Gogs 0.14.3 is available and deployed, consider restricting organization creation to trusted, authenticated users only, placing Gogs behind a WAF rule that blocks path traversal sequences in POST body parameters, and auditing existing Git hook files for unexpected content. Monitor for anomalous child processes spawned by the Gogs service binary as a secondary indicator of successful exploitation.

View the full detection rule set, including all seven SIEM queries, playbook guidance, and atomic test cases, on the CVE-2026-52813 detection page.