CVE-2026-52813

10.0 Critique

Publiée le 24/06/2026 à 23:16 · Modifiée le 26/06/2026 à 07:16 · Analyse NVD reportée · Source : security-advisories@github.com

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization names containing path traversal sequences (../) are accepted by Gogs, and repositories under them are written to paths following these path traversals. This allows storing/retrieving data for repositories at arbitrary locations on the filesystem. By creating nested structure of Git repositories, one can overwrite the other's hooks configuration to result in Remote Code Execution (RCE). This vulnerability is fixed in 0.14.3.

Traduire en français

Produits concernés

gogs

Scores CVSS

Version	Score	Source	Vecteur
3.1	10.0 Critique	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-23

Références

https://github.com/gogs/gogs/commit/f6acd467305943aae8403cbac81f0118dd1235d7
https://github.com/gogs/gogs/pull/8334
https://github.com/gogs/gogs/releases/tag/v0.14.3
https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5
https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories