CVE-2026-52806

Published: Jun 24, 2026Modified: Jun 26, 2026Deferred

9.9

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.1 / Impact: 6.0

Source: security-advisories@github.com (Secondary)

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.

Related CWEs

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

References (5)

https://github.com/gogs/gogs/commit/a9dbafbfd8e1020bacc626420238c01d75d03364

Source: security-advisories@github.com

https://github.com/gogs/gogs/pull/8301

Source: security-advisories@github.com

https://github.com/gogs/gogs/releases/tag/v0.14.3

Source: security-advisories@github.com

https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9

Source: security-advisories@github.com

https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.