CVE-2026-23633 Gogs has arbitrary file read/write via path traversal in Git hook editing
Attackers can read or write arbitrary files via path traversal in Git hook editing, compromising the Gogs self-hosted Git service.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23633?
CVE-2026-23633 is a medium-severity path traversal vulnerability in gogs, published on 6 Feb 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This issue has been patched in versions 0.13.4 and 0.14.0+dev.
Weakness: CWE-22
Which versions are affected by CVE-2026-23633?
3 open source packages ship an affected version, including gogs.io/gogs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gogs.io/gogs Go | All versions | None |
gogs.io/gogs Go | All versions | 0.13.4 |
gogs.io/gogs Go | All versions | 0.13.4 |
Products include Gogs Gogs.
How do I fix CVE-2026-23633?
Upgrade gogs.io/gogs to 0.13.4 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-23633 being exploited?
There is no known exploitation of CVE-2026-23633 in the wild and no public exploit code.
Other vulnerabilities in gogs
Sources
Also known as GHSA-mrph-w4hh-gx3g, GO-2026-4453.