Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only on the leaf of the upload target (osx.IsSymlink(targetPath)). The siblings UpdateRepoFile, DeleteRepoFile, and GetDiffPreview use hasSymlinkInPath, which lstats every component — UploadRepoFiles is the lone outlier. An attacker with repo-write access plus a multipart upload whose filename contains a literal backslash (preserved by filepath.Base on Linux, then converted to / by pathx.Clean) redirects the write through a previously-committed directory symlink. iox.CopyFile opens the destination with os.Create (no O_NOFOLLOW), so the kernel follows the parent symlink and writes attacker bytes anywhere the gogs UID can write — ~git/.ssh/authorized_keys → SSH foothold, or <repo>.git/hooks/post-receive → next-push RCE. This vulnerability is fixed in 0.14.3.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-06-23 | 1 | Disclosure1 |
| 2026-06-25 | 1 | Disclosure1 |
| 2026-06-27 | 1 | PoC1 |
CVE-2026-52813 & CVE-2026-52806 & CVE-2026-52811: Three RCE vulnerabilities in gogs, up to 10.0 rating 🔥 Recently disclosed vulnerabilities in gogs allow an attacker to execute arbitrary code. PoC exist for all three! 👉 https://nt.ls/A9o6h
Post summary
Three newly disclosed RCE vulnerabilities in Gogs (CVE‑2026‑52813, 52806, 52811) have available proof‑of‑concept code.
Warning: Multiple Critical Vulnerabilities in #Gogs. CVE-2026-52813, CVE-2026-52806 & CVE-2026-52811, max CVSS: 10.0. These flaws can lead to remote code execution #RCE! #Patch #Patch #Patch More info: https://ccb.belgium.be/advisories/warning-multiple-vulnerabilities-gogs-allow-remote-code-execution-patch-immediately
Post summary
Alerts about critical Gogs CVEs that enable remote code execution and urges an immediate patch.
🔴 Gogs, Path Traversal via Symlink, #CVE-2026-52811 (Critical) -DC-Jun2026-578 https://dailycve.com/gogs-path-traversal-via-symlink-cve-2026-52811-critical-dc-jun2026-578/
Post summary
The post announces a newly disclosed critical path traversal vulnerability in Gogs (CVE-2026-52811) and links to a DailyCVE article for more details.