CVE-2026-23633: 
Gogs vulnerability analysis and mitigation

CVE-2026-23633 is a path traversal vulnerability in Gogs, an open-source self-hosted Git service, that allows arbitrary file read and write operations via the Git hook editing endpoint. It affects Gogs versions 0.13.3 and earlier, and was disclosed on February 6, 2026. The vulnerability has been patched in versions 0.13.4 and 0.14.0+dev. It carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Gogs Security Advisory).

The root cause is improper path sanitization (CWE-22) in the endpoint /username/reponame/settings/hooks/git/:name. The :name parameter is URL-decoded by the macaron routing framework — allowing encoded slashes (%2f) to be interpreted as / — and then passed directly to git.Repository.Hook("custom_hooks", name), which resolves the path using filepath.Join(repoPath, "custom_hooks", name) without any traversal validation. An attacker can supply ../ sequences in the :name parameter to escape the custom_hooks directory: a GET request causes arbitrary file contents to be rendered in the hook edit textarea (Local File Inclusion), while a POST request overwrites arbitrary files with attacker-controlled content (Gogs Security Advisory, GitHub Advisory).

Successful exploitation allows an authenticated attacker to read sensitive files accessible to the Gogs process — such as app.ini, database files, logs, and environment variables — and to overwrite existing files with arbitrary content. Extraction of the SECRET_KEY or database credentials from configuration files could enable token forging or further system compromise. Availability is not directly impacted, but confidentiality and integrity are both rated High (Gogs Security Advisory).

No public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation at this time. The vulnerability requires the attacker to be authenticated with Admin or higher privileges on the target repository and to hold the AllowGitHook permission (or be a site administrator), which significantly limits the attack surface. The EPSS score is approximately 0.035% (0.049% per Feedly data), placing it in the 11th percentile for exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Gogs Security Advisory).

1. Reconnaissance: Identify a Gogs instance running version 0.13.3 or earlier. Confirm the target has the Git hooks feature enabled and identify a repository where the attacker holds Admin privileges with AllowGitHook permission.
2. Authenticate: Log in to the Gogs instance with an account that has repository Admin privileges and the AllowGitHook permission, or a site administrator account.
3. Craft traversal URL: Navigate to the Git hook editing endpoint with a path traversal payload in the :name parameter, e.g., /username/reponame/settings/hooks/git/..%2f..%2f..%2fetc%2fpasswd (using %2f to encode slashes so macaron decodes them server-side).
4. Read arbitrary files (GET): Send a GET request to the crafted URL. The server resolves custom_hooks/../../.../etc/passwd without validation and renders the file contents in the hook edit textarea, disclosing sensitive data such as app.ini (containing SECRET_KEY and database credentials).
5. Write arbitrary files (POST): Submit the hook edit form via POST with attacker-controlled content in the hook body field, targeting a writable file path (e.g., a configuration file or authorized_keys). The server overwrites the target file with the supplied content.
6. Escalate: Use extracted credentials or SECRET_KEY to forge authentication tokens, access the database, or pivot to further compromise of the host system (Gogs Security Advisory, GitHub Advisory).

• Network: HTTP GET or POST requests to /*/settings/hooks/git/ endpoints containing URL-encoded path traversal sequences such as %2f, %2F, or decoded ../ in the :name parameter; unusual access patterns to hook editing endpoints from admin accounts.
• Logs: Gogs access logs showing requests to /settings/hooks/git/ with .. or encoded slash sequences in the path; HTTP 200 responses to traversal-crafted hook URLs that reference files outside the repository directory.
• File System: Unexpected modifications to files such as app.ini, authorized_keys, or other system files writable by the Gogs process; timestamps on configuration files inconsistent with normal administrative activity.
• Process: Gogs process reading files outside its expected data directory (detectable via auditd or similar file access monitoring tools) (Gogs Security Advisory).

Upgrade Gogs to version 0.13.4 or 0.14.0+dev, which contain fixes for this vulnerability. As an interim measure, restrict the AllowGitHook permission to only fully trusted site administrators, and implement network-level access controls to limit exposure of the Gogs instance. Monitor Git hook modification activity for suspicious path patterns containing directory traversal sequences (Gogs Security Advisory, GitHub Advisory).

The vulnerability was reported by security researcher odgrso and disclosed by Gogs maintainer unknwon on February 6, 2026. Red Hat acknowledged the CVE in their security tracking on February 7, 2026. Coverage has been picked up by vulnerability aggregators including Vulners, VulDB, and CVEFeed, as well as a dedicated write-up on infinitsec.net, but no significant broader community debate or vendor statements beyond the official advisory have been observed (Gogs Security Advisory).