Yet another RCE in Gogs, but it's fixed this time!
aikido.dev | vulnerability | #rce | #gitlab | #xss | #path-traversal | #cve | #aikido | #gogs | #cve-2026-52813 | #git-hosting
Summary
Aikido walks through three fixed Gogs flaws—an API-reachable path-traversal RCE (CVE-2026-52813), a logic bug writing to read-only repos, and a Jupyter-render XSS—plus one unpatched bypass.
Why it matters
This vulnerability coverage helps defenders validate exposure and prioritize remediation.
- Vendor
- Gogs
- Product
- Gogs
- Published
- Collected
--- id: 6600 title: "Yet another RCE in Gogs, but it's fixed this time!" vendor: "Gogs" product: "Gogs" source_domain: aikido.dev source_url: "https://www.aikido.dev/blog/fixed-rce-gogs-cve-2026-52813" published_at: "2026-08-19T00:00:00Z" tags: ["rce", "gitlab", "xss", "path-traversal", "cve", "aikido", "gogs", "cve-2026-52813", "git-hosting"] phying_url: "https://phying.com/item/6600" lang: en --- # Yet another RCE in Gogs, but it's fixed this time! ## Summary Aikido walks through three fixed Gogs flaws—an API-reachable path-traversal RCE (CVE-2026-52813), a logic bug writing to read-only repos, and a Jupyter-render XSS—plus one unpatched bypass. ## Why it matters This vulnerability coverage helps defenders validate exposure and prioritize remediation. ## Intelligence Metadata - **Sources:** aikido.dev - **Vendor:** Gogs - **Product:** Gogs - **Published:** 2026-08-19T00:00:00Z - **Original:** https://www.aikido.dev/blog/fixed-rce-gogs-cve-2026-52813 - **Phying News:** https://phying.com/item/6600