Gogs CVE-2026-52796
LOW
GHSA-4j89-2c4f-44c6
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Low privilege (repo admin) required to set format; once set, any page load triggers the panic with no additional user interaction needed.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Lifecycle Timeline
2DescriptionGitHub Advisory
Summary
Special template of issue index pattern may cause panic.
Details
in internal/markup/markup.go
link = fmt.Sprintf(`<a href="%s">%s</a>`, com.Expand(metas["format"], metas), m)Issue index pattern is rendered to link with com.Expand.
However, com.Expand is not safe.
i = strings.Index(template, "}")
if s, ok := match[template[:i]]; ok {when { is found but } not found, i comes to 1, template[:-1] will be called, and then panicked
finally, all pages than contains issue index are unavailable.
PoC
- set issue index pattern as follow
- add a commit which point to an issue in its msg
using #1 above
Impact
DoS that cause part of pages of the specify repo unavailable.
AnalysisAI
{ placeholder, the third-party com.Expand() call in internal/markup/markup.go panics due to a negative slice index, making all repository pages that render issue references permanently unavailable until the configuration is corrected. No public exploit beyond the PoC included in the advisory is identified at time of analysis; this is not in CISA KEV.
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two conditions: (1) the attacker must have privileges to configure the repository's external issue tracker settings - typically repository owner or admin role - allowing them to set a malformed `format` string with an unclosed `{` placeholder; (2) any user (including the attacker) must subsequently trigger a page render that processes issue index references, such as viewing commit history or repository pages. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 score is 3.5 (Low) with vector AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L, reflecting limited availability impact scoped to a single repository. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A repository owner or admin on a Gogs instance running <= 0.14.2 sets the external issue tracker URL format to a malformed template such as `https://tracker.example.com/{user}/{repo}/{` (with an unclosed brace). Any subsequent commit message or page render that includes an issue reference (e.g., `#1`) triggers `com.Expand()` to panic, crashing the request goroutine. … |
| Remediation | Upgrade Gogs to version 0.14.3, which replaces the unsafe `com.Expand()` call with a custom `expand()` function using `strings.NewReplacer` that handles malformed templates without panicking (patch PR #8312, commit 0529d95fc39f2b6d2997b19a2a12e24522684722). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More from same product – last 7 days
Server-side template injection in JTL Shop 5.2.0 through 5.7.1 allows remote unauthenticated attackers to inject Smarty
Twig sandbox bypass in Pimcore CMS/DXP 12.3.8 lets authenticated administrators escape the template sandbox by abusing e
Share
External POC / Exploit Code
Leaving vuln.today