CVE-2026-52813Disclosure

HIGHCVSS 10.0 · CRITICAL

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

Patch affected systems immediately
Assume compromise if assets are exposed
Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.

Back to dashboard

7.8/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-23

Priority

HIGH

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Threat summary

Active exploitation appears in 2 classified signals
Public PoC and exploit tooling are both present
Patch or workaround signal is available
13 mentions across 10 observed days

What's happening

Active exploitation reported across 2 signals
Exploit tool or code specified in 1 signal
PoC mentioned or linked in 4 signals
Patch or workaround mentioned in 6 signals
Technical details provided in 13 signals
Disclosure: 7 classified signals
Peaked 8d ago at 2 mentions (2026-06-24); latest day: 1
13 total mentions across 10 days

Deep dive

Activity timeline13 mentions / 10d

Signal classification4 categories

Disclosure

753.8%

Patch

323.1%

Active Exploitation

215.4%

PoC

17.7%

Referenced assets13 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-23	1	Disclosure1
2026-06-24	2	Disclosure2
2026-06-25	1	Patch1
2026-06-26	2	Disclosure1PoC1
2026-06-27	1	Disclosure1
2026-06-30	1	Active Exploitation1
2026-07-03	1	Disclosure1
2026-08-19	1	Patch1
2026-08-20	2	Active Exploitation1Disclosure1
2026-09-07	1	Patch1

Full discourse13 posts

Jorian@J0R1AN34d
Disclosure
There's never enough Unauthenticated RCE's. Here I took a limited AI finding and through some clever Git structures, escalate it to Remote Code Execution on the default installation of Gogs 0.14.2! Read this and more in our latest blog post: https://www.aikido.dev/blog/fixed-rce-gogs-cve-2026-52813
Post summary
The post highlights the discovery of an unauthenticated RCE in Gogs 0.14.2 and points readers to a blog detailing the exploit, with a hint that a fix exists.
013085204.4K
2.5K followersView on X
FOFA@fofabot89d
PoC
⚠️⚠️ CVE-2026-52813 (CVSS 10.0) + CVE-2026-52806 (CVSS 9.9): Self-hosted Gogs ≤0.14.2 hit by chained RCE flaws (org-name path traversal → Git hooks; PR merge git rebase injection); public PoC released — patch to 0.14.3. 🔗FOFA Link: https://en.fofa.info/result?qbase64=YXBwPSJHb2dzIg== 🎯42.1K+ Results are found on http://en.fofa.info in the past year. FOFA Query: app="Gogs" PoC: https://gist.github.com/JorianWoltjer/4b72063338b27140f4439c524d98f2b9 🔖Refer: https://securityonline.info/gogs-rce-vulnerability/ #OSINT #FOFA #CyberSecurity #Vulnerability
Post summary
The post discloses two high‑score RCE vulnerabilities in self‑hosted Gogs, shares a public PoC, lists foaa scan results, and notes the available patch to 0.14.3.
417164176.4K
14.6K followersView on X
KEVIntel@kev_intel84d
Active Exploitation
🚨 We can confirm active exploitation of Gogs Path Traversal to RCE (CVE-2026-52813) in our honeypot sensors. Added as a KEV! Full RCE chain captured. Public PoC available. Gogs has also seen widespread exploitation in the past! https://t.co/UGBKvpytaO
Post summary
The tweet reports that CVE-2026-52813 is actively exploited in the wild, with a full RCE chain documented and a public PoC available, but does not mention any patch or detailed exploit code.
1312382.1K
61 followersView on X
Netlas.io@Netlas_io88d
Disclosure
CVE-2026-52813 & CVE-2026-52806 & CVE-2026-52811: Three RCE vulnerabilities in gogs, up to 10.0 rating 🔥 Recently disclosed vulnerabilities in gogs allow an attacker to execute arbitrary code. PoC exist for all three! 👉 https://nt.ls/A9o6h
Post summary
Three newly disclosed RCE vulnerabilities in gogs (CVE‑2026‑52813, CVE‑2026‑52806, CVE‑2026‑52811) with a 10.0 rating have been announced, with PoC available, but no active exploitation, patches, or debunking information is provided.
0402341.8K
7.7K followersView on X
YogSotho@YogSoth088d
Disclosure
#CVE-2026-52813 + CVE-2026-52806 #Exploit — #Gogs ≤0.14.2 Chained #RCE: Org-Name Path Traversal → #Git Hooks → PR Merge Rebase Injection CVE-2026-52813 (CVSS 10.0): Path traversal via organization name allows writing arbitrary files to the server filesystem, specifically malicious Git hooks into target repository .git/hooks/ directories. #security #hacking #0days
Post summary
The tweet discloses a new Gogs vulnerability (CVE-2026-52813) that allows path traversal and chained RCE via malicious Git hooks, providing CVSS and technical details but no PoC or patch information.
01033476
1.8K followersView on X
Aviatrix Threat Research Center@aviatrixtrc33d
Active Exploitation
State-sponsored attackers exploited critical Gogs RCE (CVE-2026-52813) and n8n flaws to steal 31TB from 144 US universities. Campaign used signed driver abuse and legitimate apps like AnyDesk for lateral movement. Runtime segmentation limits such internal pivoting. #ThreatIntel 🔗 Full TRC analysis: https://aviatrix.ai/threat-research-center/threatsday-august-2026-multiple-rce-vulnerabilities-gogs-n8n-circleci
Post summary
State-sponsored actors used the critical Gogs RCE CVE‑2026‑52813 (and n8n flaws) to exfiltrate 31 TB of data from 144 U.S. universities, employing signed driver abuse and AnyDesk for lateral movement—clear evidence of in‑the‑wild exploitation.
1001098
1.9K followersView on X
Kaitan ID Security@KaitanSecurity81d
Disclosure
🎯 Open-Source Git and Dev Platforms Under Siege The most alarming exploitable critical of the day belongs to CVE-2026-52813, a CVSS 10.0 path traversal flaw in Gogs (versions prior to 0.14.3) where organization names containing…
Post summary
The text announces a critical path‑traversal vulnerability (CVE‑2026‑52813) in older Gogs releases, providing technical details but no PoC, exploit, or patch information.
1000041
84 followersView on X
iototsecnews@iototsecnews16d
Patch
Gogs の脆弱性 CVE-2026-52813／52810 が FIX：パス・トラバーサルによる RCE の恐れ https://iototsecnews.jp/2026/08/29/critical-gogs-flaw-enables-remote-code-execution-through-path-traversal/ セルフホスト型 Git サービスの Gogs において、識別子の検証不備や認可処理の曖昧さに起因する重大な不具合が判明しました。攻撃者によるパスの走査／システム上での任意のコマンド実行／書き込み権限のない領域への不正なデータ保存などの被害が生じる恐れがあります。これらの不具合には CVE-2026-52813／CVE-2026-52810 が割り振られております。システムへの深刻な影響を防ぐためにも、修正が適用された最新バージョンへのアップデートや、不審な設定値の確認といった適切な処置が強く求められます。 #CVE202652810 #CVE202652813 #Gogs #Vulnerability
Post summary
A newly disclosed vulnerability (CVE‑2026‑52813/52810) in Gogs allows path traversal and remote code execution; vendors have released a fix, and users are advised to update to the latest patched version or review configuration settings to mitigate the risk.
00000140
513 followersView on X
Aikido Community Japan@AikidoCommJP34d
Patch
⚠️ 新着記事 GogsにおけるRCEを含む複数の脆弱性（CVE-2026-52813等）— バージョン0.14.3で修正済みオープンソースのGitホスティングプラットフォーム「Gogs」において、AIペネトレーションテストにより発見されたリモートコード実行（RCE）を含む複数の深刻な脆弱性が報告された。これらはバージョン0.14.3で修正されているが、一部にはまだ未修正のバイパスが残存しており、Gogsを自己ホストしている組織は早急な対応が必要である。 https://aikido-community.jp/blog/fixed-rce-gogs-cve-2026-52813 #脆弱性 #Aikido #セキュリティ
Post summary
Several severe RCE vulnerabilities in Gogs, including CVE-2026-52813, have been fixed in v0.14.3; the article urges organizations to apply the patch promptly.
00000379
830 followersView on X
CCB Alert@CCBalert89d
Patch
Warning: Multiple Critical Vulnerabilities in #Gogs. CVE-2026-52813, CVE-2026-52806 & CVE-2026-52811, max CVSS: 10.0. These flaws can lead to remote code execution #RCE! #Patch #Patch #Patch More info: https://ccb.belgium.be/advisories/warning-multiple-vulnerabilities-gogs-allow-remote-code-execution-patch-immediately
Post summary
A warning for multiple critical CVEs in Gogs (max CVSS 10 with RCE risk); users are urged to apply the available patch via the provided advisory link.
00000375
7.2K followersView on X
SecAlerts@SecAlertsCo90d
Disclosure
🪝 Gogs RCE via path traversal: CVE-2026-52813 lets attackers craft org names with `../` to write files outside the repo root, enabling arbitrary Git hook execution. CVSS 10, no auth required. Update your Gogs instance now. #infosec #AppSec https://secalerts.co/vulnerability/CVE-2026-52813?utm_campaign=x https://t.co/uVEF1QcCli
Post summary
The tweet discloses a critical RCE in Gogs (CVSS 10) via path traversal, urging users to patch immediately.
0000080
842 followersView on X
Upwind Security MDR@UpwindMDR91d
Disclosure
🚨 CRITICAL - Gogs org name path traversal to Git hook RCE (CVE-2026-52813) Gogs improperly allows organization names containing relative path traversal sequences (e.g., "../"), letting attackers force repository creation outside the intended storage root in the http://gogs.io/gogs server worktree. The root cause is path traversal due to insufficient input validation/sanitization when constructing filesystem paths from org/repo names. An attacker can exploit this remotely by self-registering and creating an organization/repository (default config), then creating nested repos to overwrite Git hook files and trigger them during Git operations. Successful exploitation results in arbitrary command execution as the git user, enabling full takeover of hosted repos and potential lateral movement/data theft from the host. 👉 Affected: http://gogs.io/gogs (versions not specified; assume all prior to vendor fix) | Upgrade to vendor-fixed version when available (No fix yet - treat as suspicious)
Post summary
A newly disclosed CVE-2026-52813 reveals a critical path‑traversal flaw in Gogs enabling remote code execution through manipulated Git hooks; the vendor has yet to release a patch, so an update to a fixed version is recommended.
0000066
226 followersView on X
DailyCVE@dailycve91d
Disclosure
🔴 Gogs Path Traversal Vulnerability Leading to Remote Code Execution, #CVE-2026-52813 (Critical) -DC-Jun2026-581 https://dailycve.com/gogs-path-traversal-vulnerability-leading-to-remote-code-execution-cve-2026-52813-critical-dc-jun2026-581/
Post summary
A new critical path traversal vulnerability – CVE‑2026‑52813 – in Gogs that can lead to remote code execution, announced on dailycve.com.
0000044
216 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-52813

Jorian[verified]@J0R1ANDisclosure

The post highlights the discovery of an unauthenticated RCE in Gogs 0.14.2 and points readers to a blog detailing the exploit, with a hint that a fix exists.

FOFA[verified]@fofabotPoC

The post discloses two high‑score RCE vulnerabilities in self‑hosted Gogs, shares a public PoC, lists foaa scan results, and notes the available patch to 0.14.3.

Netlas.io[verified]@Netlas_ioDisclosure

Three newly disclosed RCE vulnerabilities in gogs (CVE‑2026‑52813, CVE‑2026‑52806, CVE‑2026‑52811) with a 10.0 rating have been announced, with PoC available, but no active exploitation, patches, or debunking information is provided.

YogSotho[verified]@YogSoth0Disclosure

The tweet discloses a new Gogs vulnerability (CVE-2026-52813) that allows path traversal and chained RCE via malicious Git hooks, providing CVSS and technical details but no PoC or patch information.

Aviatrix Threat Research Center[verified]@aviatrixtrcActive Exploitation

State-sponsored actors used the critical Gogs RCE CVE‑2026‑52813 (and n8n flaws) to exfiltrate 31 TB of data from 144 U.S. universities, employing signed driver abuse and AnyDesk for lateral movement—clear evidence of in‑the‑wild exploitation.

Kaitan ID Security[verified]@KaitanSecurityDisclosure

The text announces a critical path‑traversal vulnerability (CVE‑2026‑52813) in older Gogs releases, providing technical details but no PoC, exploit, or patch information.

Aikido Community Japan[verified]@AikidoCommJPPatch

Several severe RCE vulnerabilities in Gogs, including CVE-2026-52813, have been fixed in v0.14.3; the article urges organizations to apply the patch promptly.

Upwind Security MDR[verified]@UpwindMDRDisclosure

A newly disclosed CVE-2026-52813 reveals a critical path‑traversal flaw in Gogs enabling remote code execution through manipulated Git hooks; the vendor has yet to release a patch, so an update to a fixed version is recommended.