---
id: 6600
title: "Yet another RCE in Gogs, but it's fixed this time!"
vendor: "Gogs"
product: "Gogs"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/fixed-rce-gogs-cve-2026-52813"
published_at: "2026-08-19T00:00:00Z"
tags: ["rce", "gitlab", "xss", "path-traversal", "cve", "aikido", "gogs", "cve-2026-52813", "git-hosting"]
phying_url: "https://phying.com/item/6600"
lang: en
---

# Yet another RCE in Gogs, but it's fixed this time!

## Summary

Aikido walks through three fixed Gogs flaws—an API-reachable path-traversal RCE (CVE-2026-52813), a logic bug writing to read-only repos, and a Jupyter-render XSS—plus one unpatched bypass.

## Why it matters

This vulnerability coverage helps defenders validate exposure and prioritize remediation.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Vendor:** Gogs
- **Product:** Gogs
- **Published:** 2026-08-19T00:00:00Z
- **Original:** https://www.aikido.dev/blog/fixed-rce-gogs-cve-2026-52813
- **Phying News:** https://phying.com/item/6600