portbuster1337/CVE-2026-52806

GitHubRepository PoCExploit

PoC files

2 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Python exploit for CVE-2026-52806, an authenticated RCE in Gogs via argument injection in git rebase. The script automates pre-flight checks, account registration, API token creation, repository setup, malicious branch push, pull request creation, and merge triggering to execute arbitrary commands on the target server.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists of a README and a Python exploit script for CVE-2026-52806, a command injection vulnerability in Gogs. The script automates exploitation of the described vulnerability by creating a malicious branch name that injects the --exec flag into a git rebase command. All behavior is consistent with a standard proof-of-concept exploit for the stated CVE. No concealed executable behavior, unrelated payload, credential theft, persistence mechanism, or operator-directed harm beyond the declared exploit was observed.

ClassificationExploit
Model confidence100%
AuthenticationRequired
LanguagesPython
Target softwareGogs
Attack typesRemote Code ExecutionCommand Injection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete Python script (gogs.py) that automates the full exploitation chain: pre-flight detection, authentication, repository manipulation, malicious branch push, pull request creation, and merge triggering to achieve remote code execution. The README explicitly describes it as an exploit and provides usage examples for running commands and reverse shells.

README.md:1-4gogs.py:1-10gogs.py:658-721

Requirements

  • Python 3.6+ with requests libraryREADME.md:43-44
  • Local git installationREADME.md:45
  • Valid Gogs credentials or ability to auto-register an accountREADME.md:20-24
  • Target Gogs instance with 'Rebase before merging' enabled or configurablegogs.py:413-431

Observed behavior

  • Performs pre-flight checks to detect Gogs, version, and registration statusgogs.py:146-212
  • Automatically registers a new user account if registration is open and no captcha is requiredgogs.py:310-331
  • Creates an API token via Basic auth or web settings pagegogs.py:333-356
  • Creates a temporary private repository and enables rebase merginggogs.py:390-431
  • Pushes a malicious branch named '--exec=sh${IFS}.payload' containing attacker commandgogs.py:438-489
  • Creates a pull request from a feature branch into the malicious branchgogs.py:491-525
  • Triggers merge with merge_style=rebase_before_merging, causing command execution via git rebase --execgogs.py:527-553
  • Cleans up temporary repository and local filesgogs.py:555-581
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Behavior
The script creates a branch named '--exec=sh${IFS}.payload' to inject a command into git rebase, matching the described CVE-2026-52806 vulnerability.This is the core exploit mechanism for the stated CVE and is not a backdoor.gogs.py:450
External Reference
The README recommends downloading and running an external 'lpe-toolkit' binary from a GitHub releases page for post-exploitation privilege escalation.This is a recommendation for a separate, external tool and is not part of the supplied artifact's executable behavior. The artifact itself does not download or execute this binary.README.md:99-114
Review boundaries

What the analysis did not establish

  • Evidence does not include execution output or verification that the exploit succeeds.
  • The artifact is a single snapshot; no version history or commit context is provided.
  • Binary or opaque content is not present; all supplied files are readable text.
  • Only the two text files (README.md and gogs.py) were provided and reviewed. No binary files were present in the evidence.
  • The review does not assess the safety or legitimacy of the externally referenced 'lpe-toolkit' binary, as it is not part of the supplied artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1