Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-52801

  CVE-2026-52801: Gogs Mirror Settings SSRF and Local Repository Import

  Any authenticated Gogs user can bypass the protection on the New Migration feature by updating a mirrored repository's address to a local filesystem path or internal URL, letting them read any repo…

• highCVE-2026-55173

  CVE-2026-55173: AVideo sanitizeFFmpegCommand OS Command Injection via Ampersand Bypass

  AVideo's incomplete patch for a prior command injection bug still lets an attacker run arbitrary OS commands on the encoder server by slipping a bare '&' shell operator past the sanitizer.

• highCVE-2026-52800

  CVE-2026-52800: Gogs CSRF Leading to Organization Owner Takeover

  A missing CSRF check on Gogs organization team management endpoints lets an attacker hijack an org by tricking a logged-in owner into opening a crafted link.

• highCVE-2026-52805

  CVE-2026-52805: Gogs Migration Redirect Bypass SSRF (Internal Repository Theft)

  Gogs lets any authenticated user steal internal Git repositories by submitting a migration URL that redirects to a private network address, bypassing the hostname blocklist because only the initial…

• highCVE-2026-52807

  CVE-2026-52807: Gogs Stored DOM-based XSS via Milestone Name on New Issue Page

  A repository collaborator can store a JavaScript payload inside a milestone name that silently executes in any visitor's browser the moment they open the New Issue page and interact with the…

• criticalCVE-2026-52806

  CVE-2026-52806: Gogs RCE via git rebase --exec Argument Injection

  Any authenticated Gogs user can run arbitrary commands on the server by naming a git branch starting with --exec= and opening a pull request that uses the Rebase merge style.

• criticalCVE-2026-52811

  CVE-2026-52811: Gogs UploadRepoFiles Arbitrary File Write via Parent Symlink

  An authenticated Gogs user with repository write access can overwrite any file the server process can reach, including SSH authorized_keys and git hooks, by uploading a file whose name contains a…

• highCVE-2026-52808

  CVE-2026-52808: Gogs Write-Level Collaborator Authorization Bypass on Admin API Endpoints

  Any repository collaborator with write access can call three admin-only Gogs API endpoints to hijack the Issues or Wiki tab with an attacker-controlled redirect URL, because the API routes use a…

• highCVE-2026-52810

  CVE-2026-52810: Gogs Git Smart HTTP Authorization Bypass via service Query Parameter Confusion

  A read-only collaborator on a Gogs instance can push commits to a repository they should never be able to write to, by forging a single query parameter on the push HTTP request.

• highCVE-2026-52812

  CVE-2026-52812: Gogs LFS Cross-Tenant Object Disclosure via Dedupe Shortcut

  A flaw in Gogs Git LFS lets any user with write access to one repository claim ownership of a private repository's stored file by uploading garbage bytes under a known OID, then download the…

• criticalCVE-2026-52813

  CVE-2026-52813: Gogs Path Traversal in Organization Name leading to RCE via Git Hooks

  Gogs accepts organization names containing ../ sequences without sanitization, letting any registered user write files to arbitrary filesystem paths and ultimately execute arbitrary commands on the…

• highCVE-2026-45048

  CVE-2026-45048: OpenAM Authenticated Privilege Escalation via Session RPC Token Disclosure

  A missing ownership check in OpenAM's session management endpoint lets any logged-in user fetch the active session token of any other user, including admins, enabling full privilege escalation.