CVE-2026-52811 Details
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only on the leaf of the upload target (osx.IsSymlink(targetPath)). The siblings UpdateRepoFile, DeleteRepoFile, and GetDiffPreview use hasSymlinkInPath, which lstats every component — UploadRepoFiles is the lone outlier. An attacker with repo-write access plus a multipart upload whose filename contains a literal backslash (preserved by filepath.Base on Linux, then converted to / by pathx.Clean) redirects the write through a previously-committed directory symlink. iox.CopyFile opens the destination with os.Create (no O_NOFOLLOW), so the kernel follows the parent symlink and writes attacker bytes anywhere the gogs UID can write — ~git/.ssh/authorized_keys → SSH foothold, or <repo>.git/hooks/post-receive → next-push RCE. This vulnerability is fixed in 0.14.3.
A vulnerability in Gogs prior to version 0.14.3 allows for arbitrary file writes outside the repository working tree. This issue arises in the UploadRepoFiles function, which only checks for symlinks at the leaf of the upload target. An attacker with repository write access can exploit this by uploading a file with a crafted filename that includes a backslash, which is then interpreted as a directory separator on Linux. The uploaded file is redirected through a previously committed directory symlink, bypassing the symlink check and allowing the attacker to write to sensitive locations such as the SSH authorized_keys file or Git hooks directory. This vulnerability is not present in Gogs Windows builds, as the Git client handles symlinks differently on that platform.
Users should update to Gogs version 0.14.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gogs/gogs/security/advisories/GHSA-89mr-xqfv-758m | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/gogs/gogs/commit/04cb8afbb01d855454e59977a1cdbf522ea1db31 | [email protected] | Source CodeVendor |
| https://github.com/gogs/gogs/pull/8332 | [email protected] | Issue TrackingVendor |
| https://github.com/gogs/gogs/releases/tag/v0.14.3 | [email protected] | Release NotesVendor |
| https://github.com/gogs/gogs/security/advisories/GHSA-89mr-xqfv-758m | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | [email protected] |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gogs | < 0.14.3 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |