CVE-2026-52806 json
Gogs: RCE via git rebase --exec argument injection in pull request merge
published 4mo ago modified 3mo ago also EUVD-2026-39073 , GHSA-qf6p-p7ww-cwr9 , GO-2026-5580
- cvss
- 9.9
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 7.9%
- EPSS 7.9% chance of exploitation in 30 days, percentile 94%
- public exploits
- 1
- Metasploit
Summary
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.
Patch / fix
- go gogs.io/gogs 0.14.3
- gogs gogs 0.14.3
- govulncheck-vulndb openSUSE Leap 16.0 0.0.20260723T184607-160000.1.1
opensuse advisories openSUSE-SU-2026:21483-1
- github.com/gogs/gogs@a9dbafb commit
- github.com/gogs/gogs#8301 pull request
- github.com/gogs/gogs/releases/tag/v0.14.3 release
Is CVE-2026-52806 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerTimeline
- First public exploit (Metasploit exploit/multi/http/gogs_rebase_rce)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- total
- Assessed
- 4mo ago
Exploit prediction
7.93% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-11).
Exploits and checks
- Metasploit exploit/multi/http/gogs_rebase_rce Gogs Git Rebase Argument Injection RCE metasploit exploit, excellent rank, 2026-03-17
- github.com https://github.com/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| GitHub | 3.1 | 9.9 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | gogs.io/gogs | <0.14.3 all versions |
0.14.3 |
Affected products
- gogs gogs
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
-
github.com
/gogs/gogs/pull/8301
web
-
github.com
/gogs/gogs/commit/a9dbafbfd8e1020bacc626420238c01d75d03364
web
-
github.com
/gogs/gogs/security/advisories/GHSA-qf6p-p7ww-cwr9
exploit, web, advisory
-
github.com
/gogs/gogs/releases/tag/v0.14.3
web
-
nvd.nist.gov
/vuln/detail/CVE-2026-52806
advisory
-
github.com
/gogs/gogs
package
Sources
- CVE List CVE-2026-52806
- GitHub Advisory GHSA-qf6p-p7ww-cwr9
- NVD CVE-2026-52806
- OSV GO-2026-5580
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.