GO-2026-5249 Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs

Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerabili...

CVE-2026-52811

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Repository.UploadRepoFiles checks for symlinks only on the leaf of the upload target osx.IsSymlinktargetPath. The siblings UpdateRepoFile, DeleteRepoFile, and GetDiffPreview use hasSymlinkInPath, which lstats every component —...

CVE-2026-52811

CVE-2026-52811 (Gogs) : In versions 0.14.0–0.14.2, UploadRepoFiles checks for symlinks only on the leaf path, while other code paths validate the entire path. An attacker with repo-write access can upload a file whose filename contains a backslash, which path normalization converts to a multi-seg...