Self-Hosted Git Service Gogs: Six Flaws Fixed in 0.14.3

Gogs, a lightweight Git service for managing source code on your own server, has six vulnerabilities (software flaws) in versions before 0.14.3. The most serious, CVE-2026-52813, scores a 10.0 out of 10 (the maximum) and lets an attacker take over the server without authentication. All six are fixed together in 0.14.3, so whether you are setting Gogs up for the first time or already running it, if your Gogs is 0.14.3 or later, no extra action is needed. If it is older, you need to update.

The six were disclosed through GitHub's security advisories, and the fix, 0.14.3, was released on June 7, 2026. As the official release list shows, 0.14.3 is still the latest stable version as of July 23, 2026, with nothing newer yet. About a month after disclosure, there are still no reports of these six being used in real attacks (they do not appear in the U.S. CISA catalog of vulnerabilities known to be actively exploited, either). That said, as noted below, Gogs has previously had a separate flaw that was actually exploited, so leaving an old version in place is dangerous.

What kind of software is Gogs?

Gogs is software that lets you run a Git service on your own server for storing and sharing program source code. It is like a self-hosted version of GitHub, handling repositories (storehouses for code), team collaboration, and change history. Written in Go, it is very lightweight—it runs on just 64 MB of memory—and it has been open source (MIT license) since 2014.

For its simplicity, it is used in place of GitHub on company and personal servers and home servers (homelabs). Because it holds source code, a company's core asset, a takeover has a large impact. All six flaws that existed before 0.14.3 are fixed in 0.14.3.

Who targets it, what they do, and what happens

For the most dangerous flaw, CVE-2026-52813, the targets are any server running Gogs on the network. This flaw requires no login, and any attacker in a position to reach the server with a request can carry it out. Instances published with open account registration widen the entry point especially.

What an attacker does is abuse a name containing a "../" string that moves up a directory level to write files to places they should not, and ultimately run arbitrary code on the server where Gogs runs. The other flaws can also lead to code execution by a logged-in user, seizure of administrator privileges, and behind-the-scenes connections into the internal network.

Once the server is taken over, it can lead to stealing or tampering with stored source code, supply-chain poisoning where malicious traps are planted in the code, and even expanding an intrusion using the same server as a foothold. The impact of a compromised development foundation can reach every product built downstream. Inspecting the components and services you bring in from outside is worth revisiting alongside the ideas in our OSS supply-chain scanner overview, and vulnerabilities that begin to be used in attacks can be tracked in our CISA KEV Dashboard (Japanese edition). In fact, this has happened to Gogs before: a separate flaw affecting older versions (0.13.3 and earlier), CVE-2025-8110, was added to the U.S. CISA list of exploited vulnerabilities in January 2026 and was actively exploited, with more than 700 instances reportedly breached. It is unrelated to these six, but it shows how dangerous it is to leave an old Gogs unpatched.

What the six vulnerabilities are

We look at them from most to least severe. Only CVE-2026-52797 is fixed in 0.14.0; the rest are fixed in 0.14.3.

CVE-2026-52813: server takeover without authentication (CVSS 10.0)

According to the published information, an organization (group) name containing a "../" string can be created, slipping past input checks to write repository data to an arbitrary location. Git has a mechanism called "hooks"—scripts that run automatically on certain operations. By nesting repositories cleverly, an attacker overwrites this hook configuration and can run arbitrary code with no authentication and no luring of any user (GHSA-c39w-43gm-34h5). With its maximum score of 10.0, it is the most dangerous of the six.

CVE-2026-52806: command injection from a pull-request branch name (CVSS 9.9)

In this flaw, when a logged-in user creates a pull request (a request to merge changes) with a specially crafted branch name, an "--exec" execution option is injected into the git command used during the merge, and arbitrary code runs on the server (GHSA-qf6p-p7ww-cwr9).

CVE-2026-52798: stored XSS in Jupyter notebook previews (CVSS 8.9)

In its preview of Jupyter notebooks (.ipynb), Gogs sanitized on the server side but did not sanitize the content when re-rendering it on the client side. Planting a link beginning with "javascript:" in a malicious notebook makes a script run when clicked, achieving stored XSS (an embedded malicious script) within Gogs.

CVE-2026-52800: seize administrator rights by getting a trap link clicked (CVSS 8.8)

This flaw is that organization member management lacked CSRF (request forgery) protection and could be operated with just a GET request. By getting a logged-in organization owner to click a crafted link, an attacker can add their own account to the Owners team and seize the organization's administrative rights wholesale.

CVE-2026-52805: behind-the-scenes connection to internal targets via the migration feature (CVSS 8.7)

This flaw is that the repository migration (import) feature does not sufficiently check the redirect destination. An attacker specifies a URL that looks legitimate at first but redirects to an internal blocked address along the way, and can import the contents of an internal repository into their own repository (SSRF).

CVE-2026-52797: out-of-path writes by crafting git diff (CVSS 8.5)

In this flaw, an authorized user crafts the values passed to the git diff command, slips past the filter, and can write the comparison results to an arbitrary location. This one is fixed in 0.14.0.

A quick reference of preconditions and severity

The six differ in "whether a login is needed" and "what must be clicked." All but CVE-2026-52797 are fixed in 0.14.3; 52797 is fixed in 0.14.0.

The most dangerous of the six is CVE-2026-52813. Because it takes over the server without authentication, instances exposed directly to the internet especially should confirm their Gogs is 0.14.3 or later.

Which version is safe, and what to check

The one thing to check is whether your Gogs is 0.14.3 or later. If it is older, get it from the 0.14.3 release and update; this single update closes all six flaws at once. Since 0.14.3 is still the latest stable version as of July 23, 2026, there is no need to look for anything newer.

If you cannot update immediately, these mitigations help: temporarily disable open account registration, and do not expose Gogs directly to the internet—limit connections to a range only trusted users can reach. Also inspect for any unfamiliar organizations or owner additions, suspicious repository or hook changes, and unfamiliar files. If a takeover is suspected, the safe move is to rotate the credentials and access tokens stored on the server after updating.

Summary

The six flaws in Gogs before 0.14.3 are varied—led by the maximum-score CVE-2026-52813 (server takeover without authentication), with code execution, seizure of administrator rights, internal connections (SSRF), and XSS. Severity ranges from 8.5 to 10.0, they affect versions before 0.14.3 (52797 before 0.14.0), and all are fixed together in 0.14.3. As of July 23, 2026, 0.14.3 remains the latest stable version, and there are no reports of these six being exploited.

Even so, Gogs has also carried a separate flaw—in 0.13.3 and earlier—that was actively exploited in the past. Because a Git service holds source code, a core asset, a takeover's damage reaches the products built downstream. If you self-host Gogs, first check your version, and if it is older than 0.14.3, update. The one conclusion to confirm is simple: is it 0.14.3 or later?

References

• ▸NVD - CVE-2026-52813 (server takeover without authentication, CVSS 10.0)
• ▸NVD - CVE-2026-52806 (command injection from branch name)
• ▸NVD - CVE-2026-52798 (stored XSS in notebook previews)
• ▸NVD - CVE-2026-52800 (CSRF seizing admin rights)
• ▸NVD - CVE-2026-52805 (SSRF in migration feature)
• ▸NVD - CVE-2026-52797 (out-of-path write via git diff)
• ▸Gogs Security Advisories (GitHub, reporter)
• ▸GitHub - gogs/gogs releases (0.14.3)
• ▸Gogs official site (product overview)