CVE-2026-52797: Gogs Path Traversal Arbitrary File Write – High Severity Update

Technical summary

The vulnerability stems from insufficient input validation and filtering in Gogs' handling of git diff command parameters. Prior to version 0.14.0, the application fails to properly sanitize user-supplied values that are passed directly to git diff operations. An authenticated attacker can exploit CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) by crafting malicious input that bypasses path restrictions, enabling arbitrary file writes outside the target directory. The git diff command then executes with attacker-controlled paths, resulting in files being written to unintended locations on the filesystem.

Business impact

Successful exploitation enables authenticated attackers to degrade or destroy system availability by filling disks or overwriting critical application files. An attacker could corrupt the Gogs installation, destroy user repositories, or modify configuration files—all without requiring elevated privileges. For organizations relying on Gogs for source code management, this threatens data integrity and operational continuity. The ability to write arbitrary files could also create stepping stones for further system compromise if sensitive configuration or application code is overwritten.

Affected systems

Gogs versions prior to 0.14.0 are vulnerable. The attack requires valid user credentials, limiting exposure to environments where authentication is enabled. Organizations running Gogs as a self-hosted Git service should immediately verify their installed version. The vulnerability does not affect systems already running Gogs 0.14.0 or later.

Exploitability

Exploitability is moderate to high in practice. The attack requires authentication (reducing the attack surface to authorized users or compromised accounts), but once inside, the exploit is straightforward—no complex interaction or unusual configuration is needed. The network-accessible nature of Gogs and the low complexity of crafting malicious diff parameters make this practical for motivated attackers with valid credentials. No user interaction is required once authenticated.

Remediation

Upgrade to Gogs version 0.14.0 or later. The fix introduces proper input validation and filtering for git diff parameters, preventing path traversal. Organizations should prioritize this upgrade immediately given the CVSS 8.5 (HIGH) severity rating and the ease of exploitation by authenticated users.

Patch guidance

Download and deploy Gogs 0.14.0 or a later stable release from the official Gogs repository. Before upgrading, back up your Gogs configuration, user data, and repositories. Test the upgrade in a non-production environment if possible to verify compatibility with your existing setup and any custom configurations. Perform a controlled rollout to production, and validate that all repositories and user accounts are accessible post-upgrade.

Detection guidance

Monitor logs for unusual git diff invocations or diff output being written to unexpected paths outside repository directories. Watch for filesystem write attempts in suspicious locations from the Gogs application process. Audit user accounts with Git access to identify if any have performed anomalous operations. Consider deploying file integrity monitoring on critical directories to detect unauthorized file modifications. Review Gogs access logs for activity from lesser-known accounts or unusual patterns of repository access.

Why prioritize this

This vulnerability merits urgent prioritization. Although it requires authentication, the CVSS 8.5 score reflects the significant availability and integrity impact. The ease of exploitation and broad potential for filesystem damage—disk saturation, configuration corruption, or repository destruction—makes this a critical security gap. Any organization running Gogs should treat patching as essential. The vulnerability is particularly concerning in multi-tenant environments or organizations with high-risk user populations where account compromise is a realistic threat.

Risk score, explained

The CVSS 8.5 (HIGH) score reflects: (1) network accessibility and low attack complexity once authenticated; (2) privilege escalation in scope (an authenticated user can affect system availability and integrity); (3) high availability impact (attackers can write large files or corrupt critical files, causing denial of service); (4) low confidentiality impact (direct data exfiltration is not the primary concern); (5) low integrity impact in the CVSS model, though practical impact is significant (file overwrite/creation). The requirement for prior authentication (PR:L) prevents a critical rating, but the broad damage potential justifies the HIGH severity classification.

Frequently asked questions