{"cve":"CVE-2026-52797","nvd":{"published":"2026-06-24T21:16:55.403","modified":"2026-06-25T14:19:40.697","status":"Deferred","description":"Gogs is an open source self-hosted Git service. Prior to 0.14.0, as an authorized user, an intruder can dictate the value which is passed to the git diff command which, together with bypassing the filtering of the passed value, allows the user to bypass the target directory and write the result of the comparison to any arbitrary path. This vulnerability is fixed in 0.14.0.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H","score":8.5},"cwes":["CWE-22"],"references":["https://github.com/gogs/gogs/security/advisories/GHSA-pm6v-2h4w-4rp2","https://github.com/gogs/gogs/security/advisories/GHSA-pm6v-2h4w-4rp2"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:41:17.107060303+00:00"},"epss":{"cve":"CVE-2026-52797","score":0.0053,"percentile":0.44823,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-pm6v-2h4w-4rp2","url":"https://osv.dev/vulnerability/GHSA-pm6v-2h4w-4rp2","summary":"Gogs: Overwriting critical files results in a denial of service","modified":"2026-07-21T13:30:31.799195982Z","packages":[{"ecosystem":"Go","name":"gogs.io/gogs","purl":"pkg:golang/gogs.io/gogs","ranges":["<0.14.0"],"fixed":["0.14.0"]}]},{"id":"GO-2026-5545","url":"https://osv.dev/vulnerability/GO-2026-5545","summary":"Gogs: Overwriting critical files results in a denial of service in gogs.io/gogs","modified":"2026-06-25T23:01:20.987118546Z","packages":[{"ecosystem":"Go","name":"gogs.io/gogs","purl":"pkg:golang/gogs.io/gogs","ranges":["all versions"],"fixed":[]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}