CVE-2026-52806 Details.
Gogs <= 0.14.2 - Authenticated RCE via git rebase Argument Injection
Atlas does not check this one. Works by exploiting the flaw.
The only reliable test for this one is to try the weakness itself, which can disturb the site. Atlas does not do that, so it does not run this check.
About CVE-2026-52806. What It Means.
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation.
Affected Product. What Is Hit.
- Vendor
- gogs
- Product
- Gogs
FAQ
Common Questions.
Gogs <= 0.14.2 - Authenticated RCE via git rebase Argument Injection. Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs allows authenticated users to achieve Remote Code Execution (RCE) on the server by creating a pull request with a specially crafted branch name that injects the --exec flag into the git rebase command during the "Rebase before merging" merge operation.
No. The only reliable test for this one is to try the weakness itself, which can disturb the site. Atlas does not do that, so it does not run this check. The facts about CVE-2026-52806 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-52806 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Gogs to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-52806. Atlas does not run a check for it, so nothing here says whether a particular site is affected.