CVE-2026-52811

CVE-2026-52811 describes a vulnerability in Gogs, an open-source self-hosted Git service, affecting versions prior to 0.14.3. The flaw exists within the `UploadRepoFiles` function, which inadequately handles symlinks by only checking the leaf of the upload target, unlike other related file operations. An attacker with repository-write access can exploit this by performing a multipart upload where the filename includes a literal backslash. This manipulation can redirect the file write through a pre-existing directory symlink, allowing the attacker to write arbitrary data to locations accessible by the Gogs user ID. This could potentially lead to an SSH foothold or remote code execution. Windows builds are not affected due to differences in how `filepath.Base` processes backslashes and Git's default handling of symlinks on that operating system.