CVE-2026-52806

creationtimestamp| type| source ---|---|--- 2026-06-19 02:19:43+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9 2026-07-13 22:00:11+00:00| seen| https://t.me/GithubRedTeam/92219 2026-07-14 00:00:19+00:00| seen| https://t.me/GithubRedTeam/922...

CVE-2026-52807

creationtimestamp| type| source ---|---|--- 2026-06-19 02:19:30+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-vcm5-gvmp-78mp...

CVE-2026-52816

creationtimestamp| type| source ---|---|--- 2026-06-19 02:19:23+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-3w28-36p9-w929...

CVE-2026-52808

creationtimestamp| type| source ---|---|--- 2026-06-19 02:19:10+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-268j-37xf-pp52...

CVE-2026-52809

creationtimestamp| type| source ---|---|--- 2026-06-19 02:19:01+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-5c3f-6486-3g7g...

CVE-2026-52810

creationtimestamp| type| source ---|---|--- 2026-06-19 02:18:21+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3 2026-06-24 22:21:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2xafiefx25 2026-09-04 05:00:04+00:00| seen|...

CVE-2026-52812

creationtimestamp| type| source ---|---|--- 2026-06-19 02:17:49+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-6p9m-q3jp-47h4 2026-06-24 22:38:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2y72dynn2f...

CVE-2026-52813

creationtimestamp| type| source ---|---|--- 2026-06-19 02:17:38+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5 2026-06-24 23:03:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mp2zkpdboz2l 2026-06-30 17:00:16+00:00|...

CVE-2026-52814

creationtimestamp| type| source ---|---|--- 2026-06-19 02:17:29+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-xp79-5mx3-jx52...

CVE-2026-52815

creationtimestamp| type| source ---|---|--- 2026-06-19 02:17:16+00:00| published-proof-of-concept| https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56 2026-06-24 03:43:07+00:00| confirmed|...

Gogs: Overwriting critical files results in a denial of service

Vulnerability type: Path Traversal Impact: DoS Exploitation prerequisite: authorized user Description: As an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the...

GHSA-PM6V-2H4W-4RP2 Gogs: Overwriting critical files results in a denial of service

Vulnerability type: Path Traversal Impact: DoS Exploitation prerequisite: authorized user Description: As an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the...

📄 Gogs 0.14.2 Argument Injection

Proof of concept exploit for an argument injection vulnerability in Gogs versions 0.14.2 and below and versions 0.15.0+dev and below. ================================================================================================================================== | Title : Gogs Git Rebase Argume...

PT-2026-51624

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3 Description Authenticated users can achieve Remote Code Execution RCE on the server during the "Rebase before merging" operation. The issue stems from improper argument handling when the software invokes the git...

Weekly Metasploit Update: Apache ActiveMQ RCE, Gogs Rebase RCE, and Windows Kernel Pointer Enum

When Open Source is a bit too Open Several fun modules landed this week, including an Apache RCE, Windows Kernel pointer collection, and Gogs RCE via naming. Leading off is Gogs' RCE that allows an attacker to execute commands by naming their branch --exec and requesting a rebase. Another useful...

📄 Gogs Git Rebase Argument Injection / Remote Code Execution

This Metasploit module exploits an argument injection vulnerability in the pull request merge flow of Gogs versions less than or equal to 0.14.2 and less than or equal to 0.15.0+dev. frozenstringliteral: true This module requires Metasploit: https://metasploit.com/download Current source:...

Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code

A critical security vulnerability has been disclosed in Gogs, a popular open-source self-hosted Git service, that allows an authenticated user to execute arbitrary code under certain conditions. The security flaw, per Rapid7, is rated 9.4 on the CVSS scoring system. It does not have a CVE...

gogs-rce

Gogs RCE — Argument Injection in git rebase CWE-88 Authen...

Exploit for CVE-2026-52806

Gogs RCE — Argument Injection in git rebase CWE-88 Authen...

CVE-2026-52806: Authenticated RCE via Argument Injection in Gogs (FIXED as of June 7, 2026)

Overview Rapid7 Labs discovered a critical argument injection CWE-88 vulnerability in Gogs, a popular open-source self-hosted Git service, tracked as CVE-2026-52806. The vulnerability, scored as CVSSv3.1 9.9 Critical, allows any authenticated user to achieve remote code execution RCE on the serve...