Path Traversal in Gogs

CVE-2026-52811

Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for symlinks only on the leaf of the upload target (osx.IsSymlink(targetPath)). The siblings UpdateRepoFile, DeleteRepoFile, and GetDiffP…

Vulnerability class: Path Traversal (Directory Traversal)

Affected products

  • Gogs — versions < 0.14.3

Weakness classification (CWE)

References