Labs

Short research notes on newly disclosed vulnerabilities: the problem, the payload, and the fix.

• highCVE-2026-52807

  CVE-2026-52807: Gogs Stored DOM-based XSS via Milestone Name on New Issue Page

  A repository collaborator can store a JavaScript payload inside a milestone name that silently executes in any visitor's browser the moment they open the New Issue page and interact with the…

• criticalCVE-2026-52806

  CVE-2026-52806: Gogs RCE via git rebase --exec Argument Injection

  Any authenticated Gogs user can run arbitrary commands on the server by naming a git branch starting with --exec= and opening a pull request that uses the Rebase merge style.

• criticalCVE-2026-52811

  CVE-2026-52811: Gogs UploadRepoFiles Arbitrary File Write via Parent Symlink

  An authenticated Gogs user with repository write access can overwrite any file the server process can reach, including SSH authorized_keys and git hooks, by uploading a file whose name contains a…

• highCVE-2026-52808

  CVE-2026-52808: Gogs Write-Level Collaborator Authorization Bypass on Admin API Endpoints

  Any repository collaborator with write access can call three admin-only Gogs API endpoints to hijack the Issues or Wiki tab with an attacker-controlled redirect URL, because the API routes use a…

• highCVE-2026-52810

  CVE-2026-52810: Gogs Git Smart HTTP Authorization Bypass via service Query Parameter Confusion

  A read-only collaborator on a Gogs instance can push commits to a repository they should never be able to write to, by forging a single query parameter on the push HTTP request.

• highCVE-2026-52812

  CVE-2026-52812: Gogs LFS Cross-Tenant Object Disclosure via Dedupe Shortcut

  A flaw in Gogs Git LFS lets any user with write access to one repository claim ownership of a private repository's stored file by uploading garbage bytes under a known OID, then download the…

• criticalCVE-2026-52813

  CVE-2026-52813: Gogs Path Traversal in Organization Name leading to RCE via Git Hooks

  Gogs accepts organization names containing ../ sequences without sanitization, letting any registered user write files to arbitrary filesystem paths and ultimately execute arbitrary commands on the…

• highCVE-2026-45048

  CVE-2026-45048: OpenAM Authenticated Privilege Escalation via Session RPC Token Disclosure

  A missing ownership check in OpenAM's session management endpoint lets any logged-in user fetch the active session token of any other user, including admins, enabling full privilege escalation.

• highCVE-2026-45049

  CVE-2026-45049: OpenAM CDCServlet Session Token Exfiltration via Unvalidated goto Redirect

  OpenAM's cross-domain SSO servlet will POST a logged-in user's raw session token to any URL supplied in the goto parameter, letting an attacker steal the session by tricking the victim into visiting…

• criticalCVE-2026-54350

  CVE-2026-54350: @budibase/server Anonymous NoSQL Operator Injection via Query Templates

  Any anonymous visitor of a published Budibase app can read or overwrite every document in the backing database by injecting MongoDB operators through an unescaped query parameter, with no login…

• highCVE-2026-53925

  CVE-2026-53925: Glances Arbitrary File Write via secure_popen Operator Injection in AMP Configuration

  Glances lets AMP module commands reach an internal shell-operator parser without any sanitization, so anyone who can write to glances.conf can overwrite arbitrary files or chain commands on the host.

• highCVE-2026-55441

  CVE-2026-55441: mise Tera exec() Injection via Untrusted Task-Include Files

  Cloning a repo that contains only a mise-tasks/ folder and running any task-listing command executes arbitrary OS commands silently, because mise renders Tera templates in task files before checking…