CVE-2026-52806 Details
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.
A remote code execution vulnerability has been identified in Gogs, an open-source self-hosted Git service, in versions prior to 0.14.3. The issue allows authenticated users to execute arbitrary code on the server by creating a pull request with a specially crafted branch name that injects the '--exec' flag into the 'git rebase' command. This exploitation occurs during the 'Rebase before merging' operation, with the malicious branch name serving as the delivery mechanism. The vulnerability is particularly concerning in multi-tenant Gogs instances, where it could lead to a complete server compromise and unauthorized access to other users' private repositories.
Users can update to Gogs version 0.14.3, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the Gogs GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/gogs/gogs/commit/a9dbafbfd8e1020bacc626420238c01d75d03364 | [email protected] | Source CodeVendor |
| https://github.com/gogs/gogs/pull/8301 | [email protected] | Issue TrackingVendor |
| https://github.com/gogs/gogs/releases/tag/v0.14.3 | [email protected] | Release NotesVendor |
| https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gogs | < 0.14.3 (semver) 0.15.0+dev (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |