GO · JUNE 2026 · EARLY WARNING

Gogs Path Traversal Vulnerability: Critical RCE Risk

Q: Am I affected?

If you are using Gogs version 0.14.2 or earlier, you are affected by this vulnerability.

Q: What should I do right now?

Upgrade to the latest version of Gogs and avoid using organization names with path traversal sequences.

Q: Has this been exploited in the wild?

There is currently no evidence that this vulnerability has been exploited in the wild.

EARLY WARNING · UNCONFIRMED. This page describes a developing threat that 0Day surfaced from early signals and has not yet independently confirmed. Details may change. Always verify against the primary sources before acting.

Severity: HIGH
Affected component: gogs (go)
Affected versions: < 0.14.3
Patched version: Not yet available

GHSA-C39W-43GM-34H5

An early warning has been issued for a critical path traversal vulnerability in Gogs that could allow remote code execution through Git hooks. Users of affected versions should take immediate action.

What happened

An early warning has been issued for a critical vulnerability in Gogs, a self-hosted Git service. The vulnerability, tracked as GHSA-C39W-43GM-34H5 and CVE-2026-52813, involves a path traversal issue in organization names. This flaw can be exploited to store or retrieve data at arbitrary locations on the filesystem, potentially leading to remote code execution through Git hooks.

The vulnerability affects Gogs versions prior to 0.14.3. There is currently no evidence that this vulnerability has been exploited in the wild. However, due to the severity of the issue, users are strongly advised to upgrade to the latest version of Gogs and avoid using organization names with path traversal sequences.

What to do about it

Upgrade to the latest version of Gogs to mitigate the risk of this vulnerability.
Avoid using organization names that contain path traversal sequences.
Monitor the primary sources for updates on this vulnerability.
Consider implementing additional security measures to protect against potential exploitation of this vulnerability.

How 0Day would have caught this

MATCHED TO YOUR ACTUAL DEPENDENCY GRAPH0Day matches every incoming threat signal against your GitHub organization’s full dependency graph, including transitive dependencies. If gogs is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.

Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.

Frequently asked questions

Am I affected?

If you are using Gogs version 0.14.2 or earlier, you are affected by this vulnerability.

What should I do right now?

Upgrade to the latest version of Gogs and avoid using organization names with path traversal sequences.

Has this been exploited in the wild?

There is currently no evidence that this vulnerability has been exploited in the wild.

Sources

[GHSA-c39w-43gm-34h5] Gogs has Path Traversal in organization name that results in RCE through Git hooks

Join the 0Day waitlist →

← Back to all threats