{"id":1083,"date":"2026-05-28T18:15:52","date_gmt":"2026-05-28T18:15:52","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=1083"},"modified":"2026-05-28T18:15:52","modified_gmt":"2026-05-28T18:15:52","slug":"critical-gogs-rce-vulnerability-lets-any-authenticated-user-execute-arbitrary-code","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=1083","title":{"rendered":"Critical Gogs RCE Vulnerability Lets Any Authenticated User Execute Arbitrary Code"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 28, 2026<\/span><\/span>Vulnerability \/ Open Source<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

A critical security vulnerability has been disclosed in Gogs, a popular open-source self-hosted Git service, that allows an authenticated user to execute arbitrary code under certain conditions.<\/p>\n

The security flaw, per Rapid7, is rated 9.4 on the CVSS scoring system. It does not have a CVE identifier.<\/p>\n

\u00abThe vulnerability allows any authenticated user to achieve remote code execution (RCE) on the server by creating a pull request with a malicious branch name that injects the –exec flag into git rebase during the ‘Rebase before merging’ merge operation,\u00bb security researcher Jonah Burgess said<\/a>.<\/p>\n

Rebasing<\/a> is a Git action that’s used to take a sequence of commits from one feature branch and replay them on top of another base branch to create a linear project history. While \u00abgit rebase\u00bb solves the same problem as \u00abgit merge\u00bb — i.e., integrating changes from one branch into another — the former rewrites the project history by creating new commits for each commit in the original branch.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The \u00abgit rebase\u00bb action also accepts as an argument a shell command via an –exec flag<\/a> that’s executed after each commit is replayed. A notable aspect of the vulnerability is that it does not require admin privileges or interaction with other users. To pull off the attack, all an unauthenticated threat actor has to do is create an account and repository on any default-configured instance.<\/p>\n

<\/p>\n

\u00abAny registered user who creates a repo is automatically its owner,\u00bb Burgess said. \u00abFrom there, enabling rebase merging is a single toggle in settings, and the entire exploit chain can be operated without interaction from any other user.\u00bb<\/p>\n

In an alternative scenario, a user with write access to a repository where rebase is already enabled can exploit the flaw directly to obtain code execution. On Gogs instances where repository creation is restricted, an attacker is required to have write access to any repository that has rebase merging enabled.<\/p>\n