What is the CVSS score of CVE-2026-52796?

CVE-2026-52796 has a CVSS 3.1 base score of 3.5 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-52796?

Yes, a patch is available for CVE-2026-52796. Update the affected software to the latest version immediately.

Gogs CVE-2026-52796

EUVD-2026-39065 LOW

Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336)

2026-06-22 https://github.com/gogs/gogs

GHSA-4j89-2c4f-44c6

Information Disclosure Ssti

3.5

CVSS 3.1 · Vendor: https://github.com/gogs/gogs

Severity by source

Vendor (https://github.com/gogs/gogs) PRIMARY

3.5 LOW

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

vuln.today AI

3.5 LOW

Network-attack vector, low privilege required, user interaction needed, availability impact only.

3.1 AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:R/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (https://github.com/gogs/gogs).

CVSS VectorVendor: https://github.com/gogs/gogs

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Source Code Evidence Fetched

Jun 23, 2026 - 00:13 vuln.today

Analysis Generated

Jun 23, 2026 - 00:13 vuln.today

DescriptionCVE.org

Summary

Special template of issue index pattern may cause panic.

Details

in internal/markup/markup.go

link = fmt.Sprintf(`<a href="%s">%s</a>`, com.Expand(metas["format"], metas), m)

Issue index pattern is rendered to link with com.Expand.

However, com.Expand is not safe.

i = strings.Index(template, "}")
if s, ok := match[template[:i]]; ok {

when { is found but } not found, i comes to 1, template[:-1] will be called, and then panicked

!image

finally, all pages than contains issue index are unavailable.

PoC

set issue index pattern as follow

!image

add a commit which point to an issue in its msg

!image

using #1 above

Impact

DoS that cause part of pages of the specify repo unavailable.

AnalysisAI

Denial of service in Gogs (self-hosted Git service) allows low-privileged authenticated users to crash the issue rendering pipeline on any repository page containing an issue reference. By setting a malformed external issue tracker URL format with an unclosed '{', the template expansion function panics, making the affected repository's pages unavailable to all viewers. A proof-of-concept is available but no active exploitation has been reported (EPSS 0.28%).

Technical ContextAI

The vulnerability stems from the use of the com.Expand function in Gogs' markup rendering at internal/markup/markup.go. This function attempts to replace template placeholders like {key} with values from a metas map. When the template string (the issue index pattern) contains a { without a matching }, strings.Index returns a small index, and slicing the string from 0 to that index causes an out-of-bounds panic (slice bounds out of range). The CWE-1336 (Improper Neutralization of Special Elements Used in a Template Engine) describes the root cause. The affected product is Gogs, a Go-based Git hosting platform (CPE: pkg:go/gogs.io_gogs), and versions prior to 0.14.3 are vulnerable.

RemediationAI

Upgrade Gogs to version 0.14.3 or later, which replaces the unsafe com.Expand with a safe expand function using strings.NewReplacer. The fix is available as a tagged release at https://github.com/gogs/gogs/releases/tag/v0.14.3. No workarounds are documented; however, as a compensating control, administrators can restrict the ability to modify repository issue index patterns to only trusted users, or disable external issue tracker integration if not needed. Note that these workarounds may limit functionality and require manual verification of repository settings.