CVE-2026-23633 — Gogs has arbitrary file read/write via path traversal in Git hook editing

CVE-2026-23633

Gogs has arbitrary file read/write via path traversal in Git hook editing PUBLISHED

Description (CNA)

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

Affected (CNA)

Vendor / product	Versions
gogs / gogs	affected < 0.14.0+dev; affected < 0.13.4

CWE

CWE-22

References

https://github.com/gogs/gogs/security/advisories/GHSA-mrph-w4hh-gx3g

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.