tag
Gogs
Gogs Wiki Arbitrary File Deletion via Path Traversal (CVE-2026-24135)
Gogs, a self-hosted Git service written in Go, contains a path traversal flaw in the updateWikiPage function used when editing wiki pages. The function sanitizes the new page title before writing the updated file but never sanitizes the previous ("old") title…
Gogs Organization-Name Path Traversal to RCE via Git Hooks — CVE-2026-52813
Gogs fails to properly sanitize the organization name supplied at organization-creation time, allowing an authenticated attacker to embed path-traversal sequences (../../...) in the name so that it resolves outside the intended organization directory and into…
Gogs Admin User Edit CSRF to Git Hook RCE
Gogs' admin user-edit route (POST /admin/users/:userid) performs the state-changing grant of IsAdmin/AllowGitHook without a CSRF token, so an authenticated site administrator can be induced (e.g., via a cross-site form submission) to grant those rights to an…