CVE-2026-52806
published 2026-06-24CVE-2026-52806: Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by…
PriorityP185critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.03%
59.4th percentile
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gogs.io | gogs | >= 0 < 0.14.3 | 0.14.3 |
| gogs | gogs | < 0.14.3 | 0.14.3 |
CVSS provenance
nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
vulncheck9.9CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Gogs up to 0.14.2 command injection (GHSA-qf6p-p7ww-cwr9)
vuldb·2026-06-26·CVSS 9.9
CVE-2026-52806 [CRITICAL] Gogs up to 0.14.2 command injection (GHSA-qf6p-p7ww-cwr9)
A vulnerability was found in Gogs up to 0.14.2 and classified as critical. This issue affects some unknown processing. The manipulation results in command injection.
This vulnerability was named CVE-2026-52806. The attack may be performed from remote. There is no available exploit.
It is suggested to upgrade the affected component.
GHSA
Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge
ghsa·2026-06-23
CVE-2026-52806 [CRITICAL] CWE-77 Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge
Gogs vulnerable to RCE via git rebase --exec argument injection in pull request merge
# Gogs: RCE via `git rebase --exec` Argument Injection in PR Merge
## Summary
Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the `--exec` flag into the `git rebase` command during the "Rebase before merging" merge operation.
## Severity
**Critical** - CVSS 3.1 Base Score: 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
## Affected Versions
- **Gogs 0.14.2** (latest supported release)
- Gogs 0.15.0+dev (commit `b53d3162`, main branch as of 2026-03-16)
- All prior versions that support the "Rebase before merging" merge style
## Impact
This is a **privilege escalation from authenticated user
VulnCheck
gogs gogs Improper Neutralization of Special Elements used in a Command ('Command Injection')
vulncheck·2026·CVSS 9.9
CVE-2026-52806 [CRITICAL] gogs gogs Improper Neutralization of Special Elements used in a Command ('Command Injection')
gogs gogs Improper Neutralization of Special Elements used in a Command ('Command Injection')
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.
Affected: gogs gogs
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://threats.wiz.io/all-incidents/cryptojacking-campaign-targeting-k8s-clusters
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-24
Published
Exploited in the wild