Vulnerabilities

CVSS

7.1 High

Vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Risk score

56.8

Published

2026-06-24

Status

Published

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query string (so ?service=git-upload-pack is evaluated as read access) while routing still runs git receive-pack, allowing push where only read should be allowed. This vulnerability is fixed in 0.14.3.

Weaknesses

CWE-284

Coverage 1

threat-intel

ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit and More

This week’s ThreatsDay bulletin highlights a diverse range of security threats, including a Remote Code Execution vulnerability in Gogs, a sophisticated Mabna Institute cyber espionage campaign targeting universities and…

The Hacker News · Aug 20, 2026 Critical

CVE-2026-52813CVE-2026-52810CVE-2026-43774IRUSrcecyber espionagegit hooks

All articles mentioning it

Advisories and references

• github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3
• github.com/gogs/gogs/pull/8331
• github.com/gogs/gogs/commit/7c9cf53aca957959bcd98b0cc987d9901b7cb184
• github.com/gogs/gogs/releases/tag/v0.14.3