Critical Gogs Flaw (CVE‑2026‑52813) Lets Authenticated Users Execute Code via Path Traversal

A severe vulnerability identified in Gogs, the open‑source self‑hosted Git service, permits attackers who have valid credentials to run arbitrary commands on the server by exploiting a path‑traversal weakness during repository creation. The issue, catalogued as CVE‑2026‑52813, was disclosed by Aikido security researcher Jorian Woltjer after it was initially reported by the GBHackers community.

The flaw resides in the handling of file paths supplied to the creation endpoint. By crafting a specially designed path that climbs out of the intended directory structure, an authenticated user can cause the server to write files to locations outside the repository tree. When those files are later interpreted or executed, the attacker gains the ability to execute code with the privileges of the Gogs process.

Because the vulnerability requires authentication, it primarily affects organizations that host their own Git infrastructure and grant access to multiple developers. In environments where the Gogs service runs with elevated system privileges, the impact can extend beyond the Git server, potentially compromising other services on the same host.

The Gogs development team responded promptly, releasing a patch that sanitizes path inputs and enforces stricter directory confinement. Users are advised to apply the update immediately and review server configurations to ensure the service does not operate with unnecessary privileges. Security best practices also recommend rotating credentials for any accounts that may have been active during the exposure window.

Security experts note that the incident underscores the broader risk associated with self‑hosted development tools, which often lack the automated update mechanisms of cloud‑based alternatives. Regular vulnerability monitoring, timely patch deployment, and limiting user permissions remain essential safeguards for organizations relying on on‑premises code hosting solutions.