Critical Gogs Path Traversal Flaw Enables Remote Code Execution via Git Hooks
Brief
A critical path traversal vulnerability in Gogs, the self-hosted Git service, could let authenticated attackers achieve remote code execution by planting malicious Git hooks outside the intended repository storage directory.
Tracked as CVE-2026-52813 , the flaw arises from an API endpoint that accepted unsanitized organization usernames and passed them to a filesystem path-construction routine. Aikido researcher Jorian Woltjer reported that the issue is fixed in Gogs 0.
- 3.
The finding underscores how small validation gaps in Git hosting software can combine with Git’s filesystem behavior to produce server-side code execution under the service account used to run Git operations remotely.
Critical Gogs Path Traversal Flaw
The vulnerable code used filepath. Join to append an organization name to the configured repository root.