CVE-2026-52806

CRITICAL EXPLOITED

Gogs: RCE via git rebase --exec argument injection in pull request merge

Title source: cna
STIX 2.1

Exploitation Summary

CVE-2026-52806 has been observed exploited in the wild (reported by VulnCheck KEV).

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.

References (4)

Core 4

Scores

CVSS v3 9.9
EPSS 0.0103
EPSS Percentile 59.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

VulnCheck KEV 2026-06-28
CWE
CWE-77
Status published
Products (1)
gogs/gogs < 0.14.3
Published Jun 24, 2026
Tracked Since Jun 25, 2026