CVE-2026-52813: Gogs: Path Traversal in organization name results in RCE through Git hooks

Synopsis

A path traversal vulnerability in Gogs, the self-hosted Git service, allows an unauthenticated remote attacker to write repository data to arbitrary locations on the host filesystem. By crafting an organization name containing ../ sequences, an attacker can overwrite Git hook configuration files belonging to other repositories. Successful exploitation results in remote code execution on the host running the Gogs server. No patched release has been published upstream; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix version is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the Gogs HTTP or SSH interface over the network; no prior foothold on the host is needed.

• AuthenticationNot required

  No account or credentials are required; the organization-creation endpoint is accessible to unauthenticated users in default Gogs configurations.

• Victim interactionNot required

  The attack is fully server-side; no user needs to click a link or open a file for exploitation to succeed.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable: crafting a path traversal in an organization name requires no race conditions, memory layout knowledge, or environmental prerequisites.

Blast Radius

• The attacker achieves remote code execution on the host by overwriting Git hook scripts, allowing arbitrary OS commands to run under the Gogs process account.
• Any file path writable by the Gogs process is reachable, exposing all repository data, secrets, and configuration files stored on the host filesystem.
• An attacker can modify or destroy repository contents belonging to other organizations, corrupting source code and commit history across the entire Gogs instance.
• The scope of impact extends beyond the Gogs application itself: other services and files co-located on the same host and accessible to the Gogs OS user are at risk of tampering or exfiltration.