CVE-2026-52811: Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym

Synopsis

A path-traversal vulnerability in Gogs, the self-hosted Git service, allows an authenticated attacker with repository write access to write arbitrary files anywhere the Gogs process user can reach on the host. The flaw is reachable over the network and requires no administrative privileges, only a low-privilege repository account. Successful exploitation lets an attacker plant an SSH authorized key or a Git hook script, giving them persistent shell access or code execution triggered on the next repository push. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The Gogs web interface is exposed over the network, so an attacker must be able to reach the service's HTTP or HTTPS endpoint to submit the malicious multipart upload.

• AuthenticationRequired

  A low-privilege account with write access to at least one repository is sufficient; no administrative credentials are needed.

• Victim interactionNot required

  The attack is fully attacker-driven through the file upload API; no other user needs to click a link or take any action.

• Attack complexityDetail

  The attack requires a previously-committed directory symlink to exist in the repository (AT:P), meaning the attacker or an accomplice must have set up that precondition, but once in place the exploit path is reliable and condition-free.

Blast Radius

• Attacker writes arbitrary content to ~/.ssh/authorized_keys under the Gogs process account, adding an SSH public key and gaining a persistent interactive shell on the host.
• Attacker overwrites or creates a Git hook such as post-receive inside any repository, causing arbitrary commands to execute as the Gogs UID on every subsequent push to that repository.
• All data accessible to the Gogs process user, including every hosted repository and their stored secrets or deploy keys, is exposed to reading, modification, or deletion.
• Downstream systems that pull from or interact with the compromised Gogs instance inherit the exposure, since hook-injected commands can reach any service the host can contact.