CVE-2026-52797
Gogs is an open source self-hosted Git service. Prior to 0.14.0, as an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the target directory and write the result of the comparison to any arbitrary path. This vulnerability is fixed in 0.14.0.
- Affected products
- Gogs
- Fix
- Available
- CVSS 3.1
- 8.5 HIGH
- EPSS
- 0.4% (36th percentile)
- Weakness
- CWE-22
- NVD status
- Deferred
- Published
- 2026-06-24
CVE-2026-52797 at NVD
No indexed exploits for CVE-2026-52797 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-52797 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.