CVE-2026-52807Disclosure

LOWCVSS 4.8 · MEDIUM

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Patch affected systems immediately
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: High priority (within 72h)

NVD description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, in new_form.tmpl, milestone names are rendered with Go's default auto-escaping ({{.Name}}), which converts < to < etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the decoded original payload. Semantic UI 2.4.2's dropdown component has preserveHTML: true as the default setting. When a user selects a dropdown item, the internal set.text() method calls jQuery's .html() with the item's text content. This re-parses the decoded text as HTML, creating the injected element and triggering the JavaScript event handler. An attacker can store an HTML/JavaScript payload in a milestone name, and when any user opens the New Issue page and interacts with the milestone dropdown, the payload executes in their browser via Semantic UI's preserveHTML behavior. This vulnerability is fixed in 0.14.3.

Back to dashboard

2.0/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-79

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Public PoC is present in monitored signal
Patch or workaround signal is available
2 mentions across 2 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Patch or workaround mentioned in 1 signal
Technical details provided in 2 signals
Disclosure: 2 classified signals
Peaked 1d ago at 1 mentions (2026-06-23); latest day: 1
2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets2 URLs

By indicator

Full discourse2 posts

The CyberSec Guru@thecybersecguru89d
Disclosure
🚨 Three Gitea/Gogs vulnerabilities just dropped — and one is a CVSS 9.8 authentication bypass. If you self-host Gitea or Gogs, this is not a “patch later” situation: ⚠️ CVE-2026-20896 — Gitea Docker auth bypass Anyone can impersonate any user with one HTTP header: X-WEBAUTH-USER: admin ⚠️ CVE-2026-52807 — Stored DOM XSS A malicious milestone name can survive escaping and execute through Semantic UI. ⚠️ CVE-2026-22874 — Webhook SSRF Gitea webhooks can become a path to AWS IMDS, cloud credentials, S3, Secrets Manager, ECR, and full cloud privilege abuse. Self-hosted Git platforms hold source code, CI/CD secrets, deploy keys, webhooks, tokens, and internal infrastructure access. Your code. Your secrets. Their access. Upgrade now: Gitea 1.26.3+ Gogs 0.14.3+ Full technical breakdown 👇 https://thecybersecguru.com/news/cve-2026-20896-gitea-authentication-bypass-dom-xss-ssrf/ #Gitea #Gogs
Post summary
The tweet announces three newly discovered Gitea/Gogs vulnerabilities, provides detailed technical information for each, links to a deeper breakdown, and urges users to apply specific patch versions.
01010157
992 followersView on X
DailyCVE@dailycve91d
Disclosure
🔴 Gogs / Gitea, DOM-Based XSS, #CVE-2026-52807 (High) -DC-Jun2026-582 https://dailycve.com/gogs-gitea-dom-based-xss-cve-2026-52807-high-dc-jun2026-582/
Post summary
The text announces the disclosure of a high‑severity DOM‑Based XSS vulnerability (CVE‑2026‑52807) affecting Gogs/Gitea, as reported on dailycve.com.
0000158
216 followersView on X

Explore more

Back to dashboard