Exploit for CVE-2026-52813

Name: Exploit for CVE-2026-52813
Rating: 5 (7 reviews)
2026-07-21 | CVSS 10.0
## https://sploitus.com/exploit?id=0D713120-944A-54D1-8462-A83F53952638
# CVE-2026-52813 – Gogs path traversal leading to remote code execution in GitHooks (Defensive Analysis)

> Security research / BlueTeam writeup. This repository **does not contain weaponized PoCs**. Researchers who need to reproduce this issue should use the public PoCs referenced in official advisories. | Project | Content |
|---|---|
| CVE | [CVE-2026-52813](https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5) |
| Alias | GHSA-c39w-43gm-34h5 / GO-2026-5305 |
| Affected Versions | **Gogs**, where malicious `hooks/update` can be executed locally in a checkout of another repository, executed by Git automatically → RCE as the `git` user. ---

## Affected Versions and Mitigations

| Gogs Version | Status |
|---|---|
| `= 0.14.3` | Fixed |

**Upgrade is the only complete fix**:
```bash
# Docker
docker pull gogs/gogs:0.14.3
# Or source code
git checkout v0.14.3 && go build
```

Temporary（when upgrading is not possible):
- **Disable registration** (`app.ini` → `[service] DISABLE_REGISTRATION = true`), lower the precondition from “unauthorized” to “existing account required”;
- Add WAF rules at the reverse proxy layers (nginx/Caddy/Traefik) to block requests to `/api/v1/user/orgs` and `/api/v1/org/*/repos` with fields `username`/`name` containing `..` or `/` (see [detection/](detection/));
- Restrict Gogs containers’ write permissions to paths outside `/data/gogs/data/tmp/` (selinux/apparmor). ---

## Root Cause Analysis

### 1. Verification asymmetry: Web side exists, API does not

Web form (`internal/form/org.go`, v0.14.2):
```go
type CreateOrg struct {
 OrgName string `binding:"Required;AlphaDashDash;MaxSize(35)"` // Regular expression ^[a-zA-Z0-9._-]+$
}
```

API (`internal/route/api/v1/org/org.go`, v0.14.2):
```go
// The binding tag for api.CreateOrgOption (go-gogs-client):
type CreateOrgOption struct {
 UserName string `json:"username" binding:"Required"` // No AlphaDashDash!
}
```

→ The `username` field in `POST /api/v1/user/orgs` can carry any character directly to the database layer. ### 2. Database layer only checks reserved names, not character sets

`internal/database/users.go:1532` `isNameAllowed` only blocks reserved names/paths like `admin`, `-bot`, **does not check character sets**, so `../` can pass. ### 3. Path sinks lack purification

`internal/repoutil/repoutil.go` (v0.14.2):
```go
func UserPath(user string) string {
 return filepath.Join(conf.Repository.Root, strings.ToLower(user)) // Directly concatenate
}
```

`internal/database/org.go:165`:
```go
os.MkdirAll(repoutil.UserPath(org.Name), os.ModePerm) // org.Name contains../ → Any path can be written to
```

### 4. Exploitation of local-r working tree hooks

When Gogs processes web/API file edits, it checksouts the repository to `/data/gogs/data/tmp/local-r//`. This path **exactly matches the database `id` of the repository**. Attackers can:
1. Create a personal repository `writer`, get `id == n`;
2.

The API triggered file operations on “writer” within the organization’s working tree → The physical directory is located in “writer”’s working tree. 
3. Created a repository named “rce-x” under that organization → It’s located at “local-r/n/nested/rce-x.git”. 
4. Cloned “writer”, submitted “nested/rce-x.git/hooks/update” as a **normal file** and pushed it (it’s located in writer’s working tree). 
5. The API triggered file operations on “writer”; Gogs executed “hooks/update” in “local-r/”. This constitutes **RCE**. Key point: The malicious hook was introduced as part of normal repository content via a normal push; there’s **no need** to enable “ENABLE_GIT_HOOKS” configuration—this is the difference between this vulnerability and traditional “git hooks abuse”. For detailed patch analysis, see [patch/ANALYSIS.md](patch/ANALYSIS.md). 

### Detection 
Full rules are available at [detection/](detection/): 
- **Sigma rules**: [detection/sigma/](detection/sigma/) — Cover attack attempts (API requests containing “..”) and successful exploitation (file system execution). 
- **SIEM queries**: [detection/queries.md](detection/queries.md) — Splunk / Elastic / Kibana / Loki. 
- **IOC detections**: [detection/iocs.md](detection/iocs.md) — File system traces, log signatures, username characteristics. 

**Two key points:** 
1. **WAF/Proxy layer interception**: Requests like “POST /api/v1/user/orgs” and “POST /api/v1/org/*/repos” have fields like “username”/“name” containing “..” or “/”. 
2. **File system inspections**: Unusual subdirectories appear in “/data/gogs/data/tmp/local-r/”, such as “nested/”, “rce-*.git”, and “hooks/update”. 

### Defensive tools 
- [tools/check_version.py](tools/check_version.py) — **Non-invasive** version scanner: Checks whether Gogs instances are **armed**. For reproduction, use the public PoC referenced in [official advisory](https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5), and perform tests only in isolated environments. 

### Experimental environment 
Rules from [detection/](detection/) need to be tested on affected Gogs. The isolated Gogs 0.14.2 environment provided in [lab/docker-compose.yml](lab/docker-compose.yml) can be used for testing rule effectiveness. **Do not expose it to the public internet; use it only locally.** 

### Timeline 
| Date | Event | 
---|---| 
| 2026-06-08 | CVE reserved | 
| 2026-06-24 | Public disclosure; Gogs 0.14.3 released | 
| 2026-06-24 | Official advisory GHSA-c39w-43gm-34h5 published | 

### References 
- Official advisory: https://github.com/gogs/gogs/security/advisories/GHSA-c39w-43gm-34h5 
- Fixing PR: https://github.com/gogs/gogs/pull/8334 
- OSV: https://osv.dev/vulnerability/CVE-2026-52813 
- Gogs 0.14.3 release: https://github.com/gogs/gogs/releases/tag/v0.14.3 

### Note regarding “gitrebase parameter injection” misinformation 
Some online sources describe this CVE as “gitrebase parameter injection leading to remote code execution”—**that’s incorrect**. This vulnerability has nothing to do with “git rebase” or “gitrebase”; the root cause is API path traversal. This document analyzes the vulnerability based on its true nature. 

### License 
MIT — See [LICENSE](LICENSE).