Detections
Analytics

SCA: security update for gogs.io/gogs (GHSA-89mr-xqfv-758m)

critical Tenable Self-Hosted Container Security Plugin ID 443819

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Gogs is an open source self-hosted Git service. Prior to 0.14.3, (*Repository).UploadRepoFiles checks for
 symlinks only on the leaf of the upload target (osx.IsSymlink(targetPath)). The siblings UpdateRepoFile,
 DeleteRepoFile, and GetDiffPreview use hasSymlinkInPath, which lstats every component — UploadRepoFiles is
 the lone outlier. An attacker with repo-write access plus a multipart upload whose filename contains a
 literal backslash (preserved by filepath.Base on Linux, then converted to / by pathx.Clean) redirects the
 write through a previously-committed directory symlink. iox.CopyFile opens the destination with os.Create
 (no O_NOFOLLOW), so the kernel follows the parent symlink and writes attacker bytes anywhere the gogs UID
 can write — ~git/.ssh/authorized_keys → SSH foothold, or <repo>.git/hooks/post-receive → next-push RCE.
 This vulnerability is fixed in 0.14.3. (CVE-2026-52811)

Solution

Update the gogs.io/gogs library and its related packages to version 0.14.3 or later.

See Also

https://github.com/advisories/GHSA-89mr-xqfv-758m

Plugin Details

Severity: Critical

ID: 443819

Version: Revision 1.5

Type: Local

Family: SCA Checks

Published: 6/23/2026

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.3

Percentile: 53.62

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 4.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSS Score Source: CVE-2026-52811

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9

Threat Score: 6.1

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 6/23/2026

Vulnerability Publication Date: 6/23/2026

Reference Information

CVE: CVE-2026-52811