Topic

Self-hosted Git service security

Vulnerabilities and hardening of self-hosted Git forges such as Gogs, including registration defaults and repository creation limits.

Current clusters

build1 distinct publisher

Gogs checks the path, then follows the symlink out of the repository

The patch for the last Gogs RCE validated the path parameter and never looked at where a committed symlink pointed. Wiz counted more than 700 already-compromised instances before v0.13.4 shipped.

Publishers:wiz.io

Reality

Evidence72
Adoption74
Hype gap+12
Incentives68

security2 distinct publishers

CVE-2026-52806 turns a Gogs branch name into command execution as the git user

Rapid7 scored it 9.9 and Gogs shipped 0.14.3 on June 7, 2026. The reason it rates that high is configuration: open registration and unlimited repository creation let a stranger own the repo they attack from.

Publishers:rapid7.comrunzero.com

Reality

Evidence84
Adoption52