{"uuid": "126e8d0d-80bc-4eed-9eac-05bd252bb6e0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-52806", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/gogs_rebase_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"Crypto-Cat\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module exploits an argument injection vulnerability (CVE-2026-52806)\\n          in the pull request merge flow of Gogs (< 0.14.3).\\n\\n          The Merge() function in internal/database/pull.go passes the PR\\n          base branch name to `git rebase` without a `--` separator. A\\n          branch named `--exec=` is parsed by Git as the --exec flag\\n          rather than a positional argument, causing `sh -c ` to run\\n          after each replayed commit during the rebase.\\n\\n          Two exploitation methods are supported:\\n\\n          - own_repo: The attacker creates a temporary repository, enables\\n          rebase merge, and operates entirely within their own account.\\n          Any authenticated user who can create repositories (the default)\\n          can exploit this with no interaction from other users required.\\n\\n          - existing_repo: The attacker exploits a repository they already\\n          have write and merge access to, where \\\"Rebase before merging\\\"\\n          is enabled (or the attacker has repo admin permissions to\\n          enable it). This path is useful on instances where repository\\n          creation is restricted.\\n\\n          Both methods use git to push divergent branches (including the\\n          malicious --exec= branch), open a pull request, and trigger a\\n          rebase merge to execute the payload. A local git installation\\n          is required.\\n\\n          On Unix targets, the payload is base64-encoded inline in\\n          the malicious branch name, avoiding the need to commit files\\n          to the repository. On Windows targets, the payload is\\n          delivered via a script file committed to the repository,\\n          since NTFS forbids pipe characters in filenames. Git for\\n          Windows uses MSYS2 sh for --exec commands, enabling\\n          cross-platform exploitation.\\n\\n          Note: a successful rebase merge may leave the server-side\\n          repository in a corrupted git state (mid-rebase). For\\n          own_repo this is inconsequential because the repository is\\n          deleted. For existing_repo this can break the target\\n          repository and prevent re-exploitation against the same repo.\\n\\n          The Gogs API does not support token deletion, so the API\\n          access token created during exploitation cannot be removed\\n          automatically and will persist under the attacker account.\", \"disclosure_date\": \"2026-03-17\", \"fullname\": \"exploit/multi/http/gogs_rebase_rce\", \"is_install_path\": true, \"mod_time\": \"2026-07-10 15:40:12 +0000\", \"name\": \"Gogs Git Rebase Argument Injection RCE\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"config-changes\", \"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/multi/http/gogs_rebase_rce.rb\", \"platform\": \"Linux,Unix,Windows\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"multi/http/gogs_rebase_rce\", \"references\": [\"CVE-2026-52806\", \"GHSA-qf6p-p7ww-cwr9\", \"URL-https://www.rapid7.com/blog/post/ve-authenticated-rce-via-argument-injection-gogs-unfixed\", \"URL-https://github.com/gogs/gogs\"], \"rport\": 3000, \"session_types\": false, \"targets\": [\"Unix Command\", \"Windows Command\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:49:49.435417Z"}