CVE-2026-23633

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, there is an arbitrary file read/write via path traversal in Git hook editing. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - security-advisories@github.com

Published

2026-02-06

Last modified

2026-02-06

Weaknesses

CWE-22

Affected products

• Gogs (Gogs)

References

• https://github.com/gogs/gogs/security/advisories/GHSA-mrph-w4hh-gx3g