CVE-2026-52798

creationtimestamp| type| source ---|---|--- 2026-06-19 02:22:07+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-jq8v-rmf6-65jw...

CVE-2026-52801

creationtimestamp| type| source ---|---|--- 2026-06-19 02:21:31+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-wv27-2vqp-j7g5 2026-06-23 03:09:57+00:00| seen| https://bsky.app/profile/suriq.io/post/3mowgfyzzvh2y...

CVE-2026-52802

creationtimestamp| type| source ---|---|--- 2026-06-19 02:21:21+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr...

CVE-2026-52806

creationtimestamp| type| source ---|---|--- 2026-06-19 02:19:43+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9 2026-07-13 22:00:11+00:00| seen| https://t.me/GithubRedTeam/92219 2026-07-14 00:00:19+00:00| seen| https://t.me/GithubRedTeam/922...

CVE-2026-52807

creationtimestamp| type| source ---|---|--- 2026-06-19 02:19:30+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp...

CVE-2026-52816

creationtimestamp| type| source ---|---|--- 2026-06-19 02:19:23+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-3w28-36p9-w929...

CVE-2026-52808

creationtimestamp| type| source ---|---|--- 2026-06-19 02:19:10+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-268j-37xf-pp52...

CVE-2026-52809

creationtimestamp| type| source ---|---|--- 2026-06-19 02:19:01+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-5c3f-6486-3g7g...

CVE-2026-52810

creationtimestamp| type| source ---|---|--- 2026-06-19 02:18:21+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3 2026-06-24 22:21:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2xafiefx25...

CVE-2026-52812

creationtimestamp| type| source ---|---|--- 2026-06-19 02:17:49+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-6p9m-q3jp-47h4 2026-06-24 22:38:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2y72dynn2f...

CVE-2026-52813

creationtimestamp| type| source ---|---|--- 2026-06-19 02:17:38+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5 2026-06-24 23:03:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2zkpdboz2l 2026-06-30 17:00:16+00:00|...

CVE-2026-52814

creationtimestamp| type| source ---|---|--- 2026-06-19 02:17:29+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-xp79-5mx3-jx52...

CVE-2026-52815

creationtimestamp| type| source ---|---|--- 2026-06-19 02:17:16+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56 2026-06-24 03:43:07+00:00| confirmed|...

Gogs: Overwriting critical files results in a denial of service

Vulnerability type: Path Traversal Impact: DoS Exploitation prerequisite: authorized user Description: As an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the...

GHSA-PM6V-2H4W-4RP2 Gogs: Overwriting critical files results in a denial of service

Vulnerability type: Path Traversal Impact: DoS Exploitation prerequisite: authorized user Description: As an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the...

📄 Gogs 0.14.2 Argument Injection

Proof of concept exploit for an argument injection vulnerability in Gogs versions 0.14.2 and below and versions 0.15.0+dev and below. ================================================================================================================================== | Title : Gogs Git Rebase Argume...

PT-2026-51624

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3 Description Authenticated users can achieve Remote Code Execution RCE on the server during the "Rebase before merging" operation. The issue stems from improper argument handling when the software invokes the git...

Weekly Metasploit Update: Apache ActiveMQ RCE, Gogs Rebase RCE, and Windows Kernel Pointer Enum

When Open Source is a bit too Open Several fun modules landed this week, including an Apache RCE, Windows Kernel pointer collection, and Gogs RCE via naming. Leading off is Gogs' RCE that allows an attacker to execute commands by naming their branch --exec and requesting a rebase. Another useful...

Gogs Git Rebase Argument Injection RCE

This module exploits an argument injection vulnerability in the pull request merge flow of Gogs is parsed by Git as the --exec flag rather than a positional argument, causing sh -c to run after each replayed commit during the rebase. Two exploitation methods are supported: - ownrepo: The attacker...

📄 Gogs Git Rebase Argument Injection / Remote Code Execution

This Metasploit module exploits an argument injection vulnerability in the pull request merge flow of Gogs versions less than or equal to 0.14.2 and less than or equal to 0.15.0+dev. frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source:...