New Gogs zero-day flaw lets hackers get remote code execution
Recorded: May 28, 2026, 3 p.m.
| Original | Summarized |
New Gogs zero-day flaw lets hackers get remote code execution News Featured Glassworm botnet disrupted after resilient C2 infrastructure takedown CISA gives feds 4 days to patch actively exploited cPanel plugin flaw Windows 11 KB5089573 update released with performance improvements Charter confirms data breach after ShinyHunters extortion threat New Gogs zero-day flaw lets hackers get remote code execution How SIEM helps MSPs reduce noise and stop threats faster Romanian gets 5 years in prison for hacking Oregon govt network Webinar: Why network incidents take too long to resolve Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityNew Gogs zero-day flaw lets hackers get remote code execution New Gogs zero-day flaw lets hackers get remote code execution By Sergiu Gatlan May 28, 2026 An unpatched zero-day vulnerability in the Gogs self-hosted Git service can allow attackers to gain remote code execution (RCE) on Internet-facing instances. Gogs servers exposed online (ShadowServer) The Validation Gap: Automated Pentesting Answers One Question. You Need Six. Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.This guide covers the 6 surfaces you actually need to validate. Related Articles: Argument Injection Sergiu Gatlan Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Upcoming Webinar Popular Stories FBI warns of Kali365 phishing service targeting Microsoft 365 accounts Microsoft Defender can now automatically isolate hacked endpoints Charter confirms data breach after ShinyHunters extortion threat Sponsor Posts Overdue a password health-check? Audit your Active Directory for free AI is a data-breach time bomb: Read the new report #1 MSP Benchmark report 2026: Insights from 1,000+ MSPs on growth, security, artificial intelligence, and key 2026 trends. Protect Your Business from Ecommerce Fraud Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
An unpatched zero-day vulnerability exists in the Gogs self-hosted Git service that permits attackers to achieve remote code execution (RCE) on internet-facing instances. This critical argument injection security flaw affects the latest release versions of Gogs, specifically Gogs 0.14.2 and 0.15.0+dev, and has yet to be assigned a formal CVE identifier. Although exploitation requires authenticated access without administrative privileges, the vulnerability is critical because the researcher Jonah Burges indicated that due to default configurations—specifically, open registration and no limit on repository creation—an unauthenticated attacker can gain initial access by simply creating an account and repository on any default-configured Gogs instance. The method for exploitation involves leveraging this flaw within the Gogs code path related to the Merge() operation. By manipulating pull requests with a malicious branch name, attackers can inject the control character '—exe'c into the git rebase command during the merge operation. A successful exploit allows the attacker to execute arbitrary code remotely as the user context of the Gogs server process. This level of access grants extensive control over the compromised server, enabling attackers to compromise the system, read every repository hosted on the instance, exfiltrate sensitive credentials such as password hashes, API tokens, SSH keys, and two-factor authentication secrets, pivot to other accessible network systems, and modify the code within any hosted repository. This vulnerability is analogous to other argument injection flaws previously addressed by Gogs, such as CVE-2024-39933, CVE-2024-39932, CVE-2026-26194, and CVE-2024-39930, though it targets a distinct code path within the Merge() function that remains unpatched. The researcher reported this flaw to the Gogs maintainers on March 17, but no patch or response has been provided, despite acknowledgement on March 28. The extent of exposure is significant; security tracking by Shadowserver currently monitors over 2,400 Gogs servers exposed online, primarily located in Asia and Europe. Contextually, the security landscape surrounding Gogs has involved previous high-severity incidents. In early December, the Gogs security team addressed another vulnerability, CVE-2025-8110, which was exploited in zero-day attacks to compromise hundreds of servers. This attention was prompted when Wiz security researchers discovered CVE-2025-8110 in July and reported it to Gogs, leading to patches being released in early January, with CISA confirming the active exploitation of that flaw and urging federal agencies to secure their servers. This history underscores the persistent risk associated with unpatched vulnerabilities in widely deployed systems and the necessity for rigorous security validation across various attack surfaces. |