CVE-2026-52806

CriticalPublished

Gogs: RCE via git rebase --exec argument injection in pull request merge

Published: Jun 24, 2026
Updated: Jun 26, 2026
Assigning CNA: GitHub_M
Evidence observed: Aug 8, 2026

Primary CVSS

9.9/ 10Critical

nvd · CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS probability estimate

7.9%

Low · next 30 days

Percentile: 94.7%
Model date: Oct 27, 2026

EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.

Summary

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation. This vulnerability is fixed in 0.14.3.

Sources

Repository evidence: Files: 2 · Repositories: 2

1 Module1 Template

Gogs Git Rebase Argument Injection RCEModule
modules/exploits/multi/http/gogs_rebase_rce.rb
Metasploit Framework modules
ExploitEvidence observed: Sep 26, 2026Revision: 54152b2f90a1Related tool
Declared conditions
- platform: Linux,Unix,Windows($.exploit_multi/http/gogs_rebase_rce.platform)
- verification: check_declared($.exploit_multi/http/gogs_rebase_rce.check)
Gogs <= 0.14.2 - Authenticated RCE via git rebase Argument InjectionTemplate
http/cves/2026/CVE-2026-52806.yaml
Nuclei Templates
DetectionEvidence observed: Sep 26, 2026Revision: dcb45914bb00Related tool
Declared conditions
- network: http($.protocol_keys)
- verification: dsl,status,word($.matchers[*].type)

Responsible use

Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.