{"id":"CVE-2026-23633","aliases":["GHSA-mrph-w4hh-gx3g","GO-2026-4453"],"url":"https://o3.security/vulnerability/CVE-2026-23633","summary":"Gogs has arbitrary file read/write via path traversal in Git hook editing","details":"## Vulnerability Description\n\nIn the endpoint:\n\n```\n/username/reponame/settings/hooks/git/:name\n```\n\nthe `:name` parameter:\n\n* Is URL-decoded by **macaron routing**, allowing decoded slashes (`/`)\n* Is then passed directly to:\n\n```go\ngit.Repository.Hook(\"custom_hooks\", name)\n```\n\nwhich internally resolves the path as:\n\n```go\nfilepath.Join(repoPath, \"custom_hooks\", name)\n```\n\nBecause no path sanitization is applied, supplying `../` sequences allows access to **arbitrary paths outside the repository**.\n\n### As a Result:\n\n* **GET:** Arbitrary file contents are displayed in the hook edit page textarea (**Local File Inclusion**).\n* **POST:** Existing files can be overwritten with attacker-controlled content (**Arbitrary File Write**).\n\n---\n\n## Attack Prerequisites\n\n* The attacker is an authenticated user\n* The attacker has **Admin or higher privileges** on the target repository\n* The attacker has the **AllowGitHook** permission (or is a site administrator)\n* The target file is readable/writable by the **Gogs process OS permissions**\n\n---\n\n## Attack Scenario\n\n1. An attacker (with AllowGitHook + repository Admin privileges) accesses the Git hook edit URL\n2. A path containing `../` is supplied in `:name`, fully URL-encoded using `%2f`\n3. The server resolves `custom_hooks/../../...` without validation\n4. Arbitrary file contents are displayed and existing files can be overwritten\n\n---\n\n## Potential Impact\n\n* **Sensitive information disclosure:** `app.ini`, databases, logs, environment variables, etc.\n* **Configuration or data tampering:** Overwriting existing files\n* **Secondary impact:** Extraction of `SECRET_KEY` and database credentials may allow token forging or further compromise","published":"2026-02-06T17:46:59.683Z","modified":"2026-08-12T03:51:29.103904931Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"gogs.io/gogs","fixedVersion":"0.13.4"}],"fix":{"url":"https://github.com/gogs/gogs/commit/4894629903f9508fe85567c44f68804f008f1655","label":"gogs/gogs@4894629"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23633.json"},{"type":"ADVISORY","url":"https://github.com/gogs/gogs/security/advisories/GHSA-mrph-w4hh-gx3g"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-23633"},{"type":"WEB","url":"https://github.com/gogs/gogs/commit/4894629903f9508fe85567c44f68804f008f1655"},{"type":"PACKAGE","url":"https://github.com/gogs/gogs"},{"type":"WEB","url":"https://github.com/gogs/gogs/releases/tag/v0.13.4"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:29.103904931Z"}}