Gogs path traversal to Git hooks RCE (CVE-2026-52813)
Vulnerability
Summary
Hide ▲
Show ▼
Gogs fixed CVE-2026-52813, a maximum-severity flaw that could lead to remote code execution through Git hooks. The bug accepted organization names containing ../ path traversal sequences, letting attackers write repository data to unintended filesystem locations and overwrite hooks configuration. The issue was addressed in version 0.14.3.
Related Happenings
Isolated-vm ExternalCopy type confusion GHSA-864f-rcv7-6rh4 remote code execution flaw
Vulnerability
H score16
First: 20.08.2026 16:48
Last: 20.08.2026 16:48
Sources 1
About this happening:
isolated-vm users face a critical ExternalCopy type confusion flaw that can let sandboxed JavaScript escape into the host process and corrupt memory across all versi...
Isolated-vm ExternalCopy type confusion GHSA-864f-rcv7-6rh4 remote code execution flaw
VulnerabilityAbout this happening: isolated-vm users face a critical ExternalCopy type confusion flaw that can let sandboxed JavaScript escape into the host process and corrupt memory across all versi...
Timeline
-
20.08.2026 20:23 2 articles · 2h ago
Gogs path traversal flaw enables Git hooks RCE
Mitigation Patch UpdateA June 2026 advisory described CVE-2026-52813 in Gogs, where organization names containing path traversal sequences (../) are accepted and repositories under them are written to filesystem paths following those traversals, allowing a nested Git repository structure to overwrite hooks configuration and achieve remote code execution. The issue was addressed in version 0.14.3, alongside fixes for CVE-2026-52810 and the XSS flaw tracked as GHSA-6vxv-wg6j-5qwp.
Show sources
- ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit and More — thehackernews.com — 20.08.2026 20:23
- ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit and More — thehackernews.com — 20.08.2026 20:23