High severity · published Jun 24, 2026
CVE-2026-52797
Gogs: Overwriting critical files results in a denial of service
8.5
CVSS
0.5%
EPSS
No
On KEV
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.0, as an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the target directory and write the result of the comparison to any arbitrary path. This vulnerability is fixed in 0.14.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
gogs · gogs
< 0.14.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-52797
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-52797
github.com
https://github.com/gogs/gogs/security/advisories/GHSA-pm6v-2h4w-4rp2
More from gogs
8.8
CVE-2025-8110
File overwrite in file update API in Gogs
10.0
CVE-2026-52813
Gogs: Path Traversal in organization name results in RCE through Git hooks
9.9
CVE-2026-52806
Gogs: RCE via git rebase --exec argument injection in pull request merge
9.9
CVE-2024-39932
Gogs through 0.13.0 allows argument injection during the previewing of changes
9.9
CVE-2024-39931
Gogs through 0.13.0 allows deletion of internal files