Gogs Supply-Chain Threat: Multiple Vulnerabilities Confirmed
Multiple high-severity vulnerabilities have been confirmed in the Gogs package, allowing attackers with repository write access to gain SSH footholds or achieve remote code execution. Users of Gogs are advised to upgrade and review repositories.
What happened
The Gogs package has been found to contain multiple critical vulnerabilities that can be exploited by attackers with repository write access. According to the GitHub Advisory Database, these issues include CVE-2026-52811, CVE-2026-52813, and CVE-2026-52806. CVE-2026-52811 allows an attacker to redirect writes outside the repository working tree via a committed parent symlink. CVE-2026-52813 enables path traversal in the organization name, resulting in remote code execution through Git hooks. CVE-2026-52806 permits remote code execution via git rebase --exec argument injection in pull request merges.
The root cause of these vulnerabilities appears to be an asymmetric check for symlinks in the UploadRepoFiles function, as well as insufficient validation of organization names and pull request merge arguments. These flaws can be leveraged by an attacker to gain unauthorized access or execute arbitrary code on the affected system.
To assess your exposure, review the Gogs repositories you maintain for any unauthorized changes. It is strongly recommended to upgrade to the latest version of Gogs to mitigate these vulnerabilities. For more details, consult the primary sources: [GHSA-89mr-xqfv-758m](https://github.com/advisories/GHSA-89mr-xqfv-758m), [GHSA-c39w-43gm-34h5](https://github.com/advisories/GHSA-c39w-43gm-34h5), and [GHSA-qf6p-p7ww-cwr9](https://github.com/advisories/GHSA-qf6p-p7ww-cwr9).
How 0Day mitigates this
gogs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.